Add error checking to Windows eventchannel

There was pretty much no error checking in the eventchannel code. Adding
error checking obviously has the benefit of catching and logging errors
but it also helps in readability. It is now a bit easier to understand
what the code is doing and where things can go wrong and why.

A good example of this is many of the Windows system calls are done
twice. The first call is done to determine the buffer size necessary to
hold the data a proper call would produce. This allows for the right
amount of memory to be allocated. This first call actually fails but it
fails in a very predictable manner. Unexpected failures should be
accounted for.

Reworked get_messages() to be get_message() which is less code and a bit
more dynamic in what it can do. There are a number of events (shown
below) someone might want to access and this new function allows for
that pretty easily.

typedef enum _EVT_FORMAT_MESSAGE_FLAGS {
  EvtFormatMessageEvent     = 1,
  EvtFormatMessageLevel     = 2,
  EvtFormatMessageTask      = 3,
  EvtFormatMessageOpcode    = 4,
  EvtFormatMessageKeyword   = 5,
  EvtFormatMessageChannel   = 6,
  EvtFormatMessageProvider  = 7,
  EvtFormatMessageId        = 8,
  EvtFormatMessageXml       = 9
} EVT_FORMAT_MESSAGE_FLAGS;

Changed many of the functions to return errors when they are
encountered. Those errors might not be accounted for because they
frankly don't need to. The data being gathered just won't be displayed
in the final log message. The errors happening inside the functions will
also be logged for review later.

Made a lot of changes to the code format to improve readability. Things
like spacing and changing variable names went a long way. Some things
were a bit inconsistent.

Found that a few variables were not being declared NULL to begin with
which had the potential for errors later. Specifically, the os_event
structure in send_event_channel() seemed to be prone to this.

Created new functions to handle the opening, creating and updating of
the bookmarks. Also, made some improvements in how that is all handled
but there is still a lot that can be done which will come in a future
commit.

With the bookmark code, access() was used which has the common time of
check, time of use pitfalls. This has been removed in favor of just
opening the file and asking forgiveness later.

Finally, the last notable thing to discuss is that wcstombs_s() was not
converting many of the event log messages. This was able to be
successfully reproduced by generating the logs produced when a user
access the system using RDP. It's possible there was an issue with how
wcstombs_s() was being used by switching to WideCharToMultiByte() solved
the issue. Since this code does not need to be cross platform this seems
like the preferable choice when presented with both anyway.