Added process.args_count

[webmat]

In ECS we genrally try to avoid adding counts fields for arrays, if the count
will only be used for display purposes.
This can be calculated on the fly by the consumer, or via a scripted field.

This case is different, however. Following the premise that a process requiring
more arguments may be more suspect than a process started with very few arguments,
then creating analysis content or performing searches for args_count > N becomes
valuable.

cc @rw-access @randomuserid

[rw-access]

LGTM. I've used things like this before
process.name:"powershell.exe" and command_line:"* *" to infer that it was executed with additional arguments.

That was inefficient, so switching to process.name:"powershell.exe" and process.args_count:>1 will help performance significantly.