dynamic: Time Travel Debugging (TTD) integration

Nobody has claimed this yet.

### Summary

Develop a `TTD exctractor` and add keywords to the rules to use trace files generated by TTD to improve `capa` dynamic analysis and defeat packers.

### Motivation

Because `capa` is trying to develop some dynamic analysis features, I would like to suggest using [Microsoft TTD](https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/time-travel-debugging-overview). Thanks to TTD, you can generate trace files that record the context of the binary at each instruction.
I could develop a `TTD extractor` that would add new features to `capa` from the trace file.

In the end, one could scan a binary sample with a TTD trace and use new rules to select a position in a trace where `capa` should work.
The `TTD extractor` would need time indicators to know when to scan in the timeline. These indicators can be TTD cursors (time position) or functions that would be hooked in the trace.
Also, the extractor would require a memory range to scan. Hence, several optimizations can be developed like scanning the heap, the module memory, the stack...

Here is a quick look of what a rule could look like:
```yml
...
- ttd:
- time:
- cursor: ["100:0", "200:a"] # provide hardcoded time position
- hook: ["ntdll!NtCreateThreadEx", "ntdll!NtCreateUserProcess"] # provide functions to hook
- memory: ["heap", "module"] # select memory ranges to scan
...
```
This rule tries to detect thread and process creation, and scan the heap at these time positions to search some shellcode that could be loaded by a packer, or some useful strings loaded dynamically.

### Alternative projects

I'm currently working on https://github.com/airbus-cert/yara-ttd which aims to apply yara rules on TTD trace files thanks to these [TTD bindings](https://github.com/commial/ttd-bindings).
The tool is currently working and has many use cases when dealing with yara rules on a packed binaries.

I also read the [dynamic-feature-extraction branch](https://github.com/mandiant/capa/tree/dynamic-feature-extraction) you are working on to integrate CAPE.
The TTD integration could work alongside this project to provide a more precise analysis and an in-depth dynamic memory scan.

---
I didn't started yet to implement the extractor because I wanted some validation from the `capa` team before. Of course, I will welcome any kind of advice!

Start by reviewing the dynamic-feature-extraction branch and the existing yara-ttd project with its TTD bindings. Then inspect capa's rule and extractor architecture to determine how TTD cursors, hooks, and memory ranges would fit. Done means the capa team has an agreed integration design and a working TTD extractor with corresponding rule support.

Written by the indexing model from the issue text.