FPR: add sleuthkit rules

This adds two new FPCommands and associated rules:

* fiwalk, used as a characterization tool to identify files inside disk images
* tsk_recover, used as an extraction tool to extract the contents of disk images

Both of these are associated with the sleuthkit FPTool, since they both are a part of that package.

Both are associated with the ISO, raw disk image, and AFF formats.