Allow event/alert creation based on message receive time

Some use cases require event/alert creation based on the log message receive time instead of the regular `timestamp`. One example are log messages which you cannot consume in a near real-time fashion like AWS logs. Those logs might arrive several minutes after their actual creation because they are buffered internally inside AWS. (e.g. reading ELB logs from S3) The timestamps of these logs can be way into the past so they might not be included in the "search within" window of an event definition execution. (thus resulting in missed alerts)

For those use cases it would be useful to allow users to switch the "search within" option to look at the message receive time instead of the regular `timestamp` of the message. The message receive time will be available once https://github.com/Graylog2/graylog2-server/issues/6028 gets implemented.

See https://github.com/Graylog2/graylog2-server/issues/6456#issuecomment-537628614 for details of a specific use case with AWS security group events.