X509 folder move, table improvement, update for v1.4.0

[JW-Corelight]

Move x509 folder under version folder and reorg README table structure for consistency with other logs.

[mavam]

How did you figure out the TLS extensions to map to?

[JW-Corelight]

I think you're talking about the type values i gave the ones with type_id="99".
https://schema.ocsf.io/1.4.0-dev/objects/tls_extension

I gave them the exact name of the field they're coming from, assuming that's how they work.

If I'm misuderstanding this, i'm happy to realign.

[mavam]

My understanding was that the TLS extension names comes from the RFC: https://datatracker.ietf.org/doc/html/rfc8446#page-35. At least that's where the schema links.

[JW-Corelight]

After reviewing this again, I think I'm seeing what you're saying here @mavam

The TLS Extensions are used by the TLS protocol while the connection is set up, while the 'other' Zeek fields I'm attempting to fit into there are really just details about the cert itself. They seem to belong in the tls.certificate object instead of tls.tls_extension_list