Use more fields to address dynamic address processes

While working on the DRAKVUF sandbox, we noticed that sometimes processes would have the same PID and PPID and would therefore be fused together in the final generated JSON sandbox report. It would be nice to have some type of way to distinguish between processes.

DRAKVUF (the monitor) gets around this by specifying more fields while reporting each api call that was made or file that was accessed. These fields include ts_from (time when the process was created), ts_to (time where process ended), as well as process name. As for the DRAKVUF sandbox, then the devs have now added a new "_SEQID_" field that's an alphanumeric value that's generated from ts_from and ts_to, so it might be nice to use one of these two ideas to distinguish between processes with the same PID and PPID.

I think this issue has come up in the past, and I think that maybe we could add an extra field (maybe call it _inner_?) that we could add to the `capa.features.address.ProcessAddress` class, and then in the case of the DRAKVUF sandbox we could put the newly added SEQID there and use it to tell which process is which. Alternatively, we could register the ts_from and ts_to into ProcessAddress and use it to tell processes apart for all sandboxes?

I am not sure how different sandboxes tackle this issue, so maybe some research is needed to try and find a common ground between all of them that we factor out into the `ProcessAddress` class. I am using the issue to get a conversation started on it.

Start by tracing capa.features.address.ProcessAddress and the sandbox JSON process-identity handling. Compare how DRAKVUF and other sandboxes represent ts_from, ts_to, process names, or _SEQID_. Done means documenting a common discriminator and agreeing on a field or interface that prevents processes with the same PID and PPID from being fused.

Written by the indexing model from the issue text.