Keep original login during the session

Add:
 - `starter`: the session initiator (AKA login).
 - `euid`
 - `gid`: only primary group.
 - `egid`

This is useful to track action even after a user change (such as `su` or `sudo`).

For a much simpler analysis, numerical IDs are resolved to their actual text values.

log examples:

````
user@host:~ $ ls
Jan  9 00:37:12 host snoopy[1071]: [starter:user, uid:user euid:user gid:user egid:user sid:1069 tty:/dev/pts/1 cwd:/home/user filename:/bin/ls]: ls
`````
`````
user@host:~ $ sudo ls
Jan  9 00:38:30 host snoopy[1072]: [starter:user, uid:user euid:user gid:user egid:user sid:1069 tty:/dev/pts/1 cwd:/home/user filename:/usr/bin/sudo]: sudo ls
Jan  9 00:38:31 host snoopy[1075]: [starter:user, uid:root euid:root gid:root egid:root sid:1069 tty:/dev/pts/1 cwd:/home/user filename:/bin/ls]: ls
`````