Second order anomalies

This is an attempt at implementing "second-order anomalies", whereby we only alert if an anomaly is anomalously anomalous - ie, a metric is triggering more or less often than usual. This embraces the fact that there will be noise using 3-sigma based algorithms and instead applies 3-sigma to the triggers, which hopefully are normally distributed. More analysis is needed to determine how effective this solution is, but I figured I would put it out there and get some feedback before merging. Background: [https://speakerdeck.com/astanway/mom-my-algorithms-suck](Monitorama.eu)