Add socketfilterfw parser table

[Micah-Kolide]

With the release of MacOS 15, Apple has deprecated the use of a plist for application firewall settings. Instead they say to use socketfilterfw if you relied on the plist in past versions.

osquery does not have a pattern for executing and parsing data from binaries (yet), so I've added this table to fill in the gap if that table stays unsupported for MacOS 15.

[Micah-Kolide]

osquery> SELECT * FROM kolide_socketfilterfw ORDER BY fullkey;
+-----------------------------------+--------+---------------------------------+-----------+-------+
| fullkey                           | parent | key                             | value     | query |
+-----------------------------------+--------+---------------------------------+-----------+-------+
| 0/allow_built-in_signed_enabled   | 0      | allow_built-in_signed_enabled   | 1         | *     |
| 0/allow_downloaded_signed_enabled | 0      | allow_downloaded_signed_enabled | 1         | *     |
| 0/block_all_enabled               | 0      | block_all_enabled               | 0         | *     |
| 0/global_state_enabled            | 0      | global_state_enabled            | 1         | *     |
| 0/logging_enabled                 | 0      | logging_enabled                 | 1         | *     |
| 0/logging_option                  | 0      | logging_option                  | throttled | *     |
| 0/stealth_enabled                 | 0      | stealth_enabled                 | 0         | *     |
+-----------------------------------+--------+---------------------------------+-----------+-------+
osquery> SELECT * FROM kolide_socketfilterfw_apps ORDER BY fullkey;
+------------------------------+--------+----------------------------+---------------------+-------+
| fullkey                      | parent | key                        | value               | query |
+------------------------------+--------+----------------------------+---------------------+-------+
| 0/allow_incoming_connections | 0      | allow_incoming_connections | 1                   | *     |
| 0/name                       | 0      | name                       | replicatord         | *     |
| 1/allow_incoming_connections | 1      | allow_incoming_connections | 0                   | *     |
| 1/name                       | 1      | name                       | Pop Helper.app      | *     |
| 2/allow_incoming_connections | 2      | allow_incoming_connections | 1                   | *     |
| 2/name                       | 2      | name                       | Google Chrome       | *     |
| 3/allow_incoming_connections | 3      | allow_incoming_connections | 1                   | *     |
| 3/name                       | 3      | name                       | rtadvd              | *     |
| 4/allow_incoming_connections | 4      | allow_incoming_connections | 1                   | *     |
| 4/name                       | 4      | name                       | com.docker.backend  | *     |
| 5/allow_incoming_connections | 5      | allow_incoming_connections | 1                   | *     |
| 5/name                       | 5      | name                       | sshd-keygen-wrapper | *     |
+------------------------------+--------+----------------------------+---------------------+-------+

[RebeccaMahany]

LGTM once seph's comments are addressed!

[RebeccaMahany]

LGTM, had a final nitpick for conciseness