Parsing .NET EventSource about krabsetw

[swannman]

Hi @bobsira, krabsetw should be able to subscribe to EventSource providers from both C# and C++:

• First, translate your EventSource provider name to an ETW provider ID: here's an example.
• Next, use RawProvider (in C#) or krabs::provider<> (in C++) to subscribe to the ETW provider ID
• When you receive an event callback:
  • In C#, convert the contents of the event to a ReadOnlySpan and parse it accordingly: new ReadOnlySpan<byte>(record.UserData.ToPointer(), record.UserDataLength);
  • In C++, use the UserData and UserDataLength properties of EVENT_RECORD to access the contents of the event