Fix formatting of event channel code

Remove excess whitespace among other things. No code changes made.
Fix read_win_event_channel.c permissions
Fix Windows Event Channel format

Work toward fixing issue #224. The event channel output was multiline
which was causing issues for users.

Found that the old event log code was getting subjected to some string
manipulation that was removing newlines and replacing tabs after
argument fields with spaces.

Moved this code to a central location so both the old and new can be
subjected to the same manipulation. Decided to call this function
win_format_event_string().

Despite this change, the output from the two event log gathering methods
still differs slightly. The old event log message seems to go through a
few other things that can change the string liek FormatMessage(), which
is a Windows system call.

During a small amount of testing it did not appear the old event log
gathering ever needed to have newlines removed and tabs replaced. It
appears that either the logs are coming out that way or the formatting
is being done somewhere previously in the code. Perhaps, FormatMessage()
is doing it.

That said, the event channel stuff certainly does get affected by
win_format_event_string() so it more closely matches it's counterpart
albeit not exactly.
Fix manage agents error messaage compile warning
Fix include order warnings when compiling win32

Let shared.h include handle the inclusion of all the necessary Windows
libraries. This is similar to 1e2406f4. Fixes the following warning:

from shared/randombytes.c:10:
	warning: #warning Please include winsock2.h before windows.h
Merge pull request #448 from awiddersheim/fix_manage_agents_warning

Fix manage agents error messaage compile warning
Merge pull request #449 from awiddersheim/fix_win_compile_warning

Fix include order warnings when compiling win32
fix to sshd rules
I don't know where the [preauth] comes from but I don't see it in my log messages and at least for the corrupted MAC messages I had to remove it so rule 1002 does not kick in.
Fixes to event channel output

Put parenthesis around 'no user' to match what the event log code does.
More cleanup of tabs in eventlog and eventchannel
fix rule testing
it turns out the [preauth] postfix is optional in openssh so not always present. This should account for that.
added apache tests
the log samples come from decoder.xml
fix newline at end of file
fix testcase
This line was suspicious from the beginning but I forgot to correct it. Now it works.
Fixes to event channel output

Instead of only pulling out certain events from the event logs with
event channel pull out everything. This is how nxlog does it and they
seems to have a good handle on eventlog and eventchannel. Good designers
copy, great designers steal. Much thanks goes to nxlog and keeping their
source open. It has been a great help. The people over at Zabbix also
seem to have a similar tool that also has good code to look at for
inspiration and examples.

Not sure if there is any benefit to only pulling out certain events
from the event log. Perhaps, there is some performance benefit. Seems
like nxlog finds it acceptable and their software is quite fast so I
doubt it is of major significance.

These changes again bring the output of the eventlog code and the new
eventchannel code closer together.
Merge pull request #451 from ChristianBeer/apache-tests

Apache tests added
catching PHP notices in Apache log
The level is 5 because these message reveal deprecated or problematic php code. I don't had any PHP Errors on my Apache 2.4 so I can't include a rule for those.
Merge branch 'master' into apache24-php-notices
add testcase for new rule
add newline to end of file