Add geolocation data to notice logs

[philrz]

The changes in this PR will populate the remote_location record in all notice events with geolocation data that's available for the IP address that's perceived to be the "remote" side of the connection that generated the event (see docs for more detail). Thanks to @JustinAzoff from the Zeek team that offered the tip in zeek/zeek#3674 for how we can accomplish this for all flavors of notice event while continuing to consolidate all our config changes in local.zeek.

I've tested using an artifact from this actions run and the test data in repro2.pcap.gz.

$ cat repro2.pcap | ~/Downloads/zeek-fdea29d/zeek/zeekrunner -

$ zq -Z '*SSL*' notice.log 
{
    _path: "notice",
    ts: 2015-03-11T09:38:43.633846Z,
    uid: "Cy06cy2L5swZ1l7Ryl",
    id: {
        orig_h: 192.168.0.51,
        orig_p: 48543 (port=uint16),
        resp_h: 2.22.42.85,
        resp_p: 443 (port)
    },
    fuid: "Fw3yYj47FjADHwdzhj",
    file_mime_type: null (string),
    file_desc: null (string),
    proto: "tcp" (=zenum),
    note: "SSL::Invalid_Server_Cert" (zenum),
    msg: "SSL certificate validation failed with (unable to get local issuer certificate)",
    sub: "CN=www.paypalobjects.com,OU=CDN Support,O=PayPal\\, Inc.,L=San Jose,ST=California,C=US",
    src: 192.168.0.51,
    dst: 2.22.42.85,
    p: 443 (port),
    n: null (uint64),
    peer_descr: null (string),
    actions: |[
        "Notice::ACTION_LOG" (zenum),
        "Notice::ACTION_ADD_GEODATA" (zenum)
    ]|,
    email_dest: |[]| (|[string]|),
    suppress_for: 1h,
    remote_location: {
        country_code: "SE",
        region: "AB",
        city: "Liljeholmen",
        latitude: 59.3199,
        longitude: 18.0123
    }
}

Closes #10

[nwt]

No need for cat here.

Suggested change

	cat << 'EOF' | $sudo tee -a /usr/local/zeek/share/zeek/site/local.zeek
	$sudo tee -a /usr/local/zeek/share/zeek/site/local.zeek << 'EOF'