Handle migration from app_skeleton logstash-1.2.2

We need to stop it from running via upstart, and ensure any old
process is killed.

Also:

* ensure logstash process cannot write to its own config files, and
* ensure conf.d and patterns dirs are cleaned of unexpected files.
Ensure tests pass in Vagrant
README update
Add tests for 200_filter_all config

Many of the tests in syslog_input_spec.rb do not need to be
tested via the syslog input - we just need to ensure that
the data provided to a filter-only config object is as it would
be if the syslog filter had parsed the original event.

This sets up the structure for moving most of the syslog_input_spec
tests out of there, and just ensuring that the syslog input is
doing what we expect.
Simplify type=>syslog tests via a direct filter test suite

The hacking to get a syslog input handler in place is excessive for
most of our tests, when all we need to know is that the filter configuration
has received the message from the input in the right form.

Migrate the syslog_input_test test cases into a specific test based
around the 200_filter_all config.
Fix apparmor events overwriting 'type' field

'kv' filter needs to be used with care, it can easily overwrite
core fields - like 'type' in this case.

Flesh out the tests with other apparmor data too.
Fix syslog '@message' mutate config bug.

We were incorrectly writing syslog_message field to @message, thinking
we were overwriting 'message' field that the message is actually stored
in (at least at v1.4.x).

This corrects this issue, in two ways:

* Leave syslog_message intact - it has semantic meaning.
* * Do not overwrite the source 'message' field -- we will want to use that for reloading.
*