Skip over bad entries in UAL while parsing data

[JazzCore]

While running ual.clients_access on one machine got this exception:

Traceback (most recent call last):
  File "/home/user/venv/bin/target-query", line 6, in <module>
    sys.exit(main())
             ^^^^^^
  File "/home/user/venv/dissect/dissect.target/dissect/target/tools/utils/cli.py", line 475, in wrapper
    return func(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^
  File "/home/user/venv/dissect/dissect.target/dissect/target/tools/query.py", line 260, in main
    for record in record_generator:
                  ^^^^^^^^^^^^^^^^
  File "/home/user/venv/dissect/dissect.target/dissect/target/plugins/os/windows/ual.py", line 226, in client_access
    for path, client_record in self.read_table_records("CLIENTS"):
                               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/user/venv/dissect/dissect.target/dissect/target/plugins/os/windows/ual.py", line 219, in read_table_records
    for table_record in parser.get_table_records(table_name):
                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/user/venv/dissect/dissect.database/dissect/database/ese/tools/ual.py", line 61, in get_table_records
    value = wintimestamp(value)
            ^^^^^^^^^^^^^^^^^^^
  File "/home/user/venv/lib/python3.12/site-packages/dissect/util/ts.py", line 187, in wintimestamp
    return _calculate_timestamp(float(ts) * 1e-7 - 11_644_473_600)  # Thanks FireEye
                                ^^^^^^^^^
TypeError: float() argument must be a string or a real number, not 'NoneType'

ual.clients_seen gave me same exception, but now in DNS UAL table.

For CLIENTS table this was caused by entry without any data in it - all columns for it were not defined, so None was passed in wintimestamp, which gave exception.
For DNS table - faulty entry had more defined columns than DNS schema expected, which resulted in regular string passed to wintimestamp.

First i went with a fix to wintimestamp to use try-except and just return None on bad timestamps, but IMO it does not cover all cases, so instead I ended up adding verification for UAL entries to check if they are empty or matches table schema. For schema matching it just checks that entry does not have more columns than in schema (a lot of them have lower values, for ese it just means that value in that column is empty, as I understood).

is_empty and matches_schema can be used in another ese code, but since it will skip over data that can be carved in some cases (which can be useful), I limited it to just UAL.

Test for it was a real pain because of double checksumming with ECC in ese. Used existing test and added to it empty and schema-mismatch records to give same exceptions as in my case. DB is correct and can be parsed with Eric Zimmerman's SumECmd (but it requires patching to remove hardcoded requirement for SystemIdentity.mdb). I verified this test (and my faulty real UAL) against it to ensure that results matches.

[Schamper]

Probably this can be a property too?

[Schamper]

Perhaps until we have other places to use it, it can be fine to just inline the logic from column_counts in here. So we don't need the change to the Table class.

[Schamper]

Perhaps add a is_valid property that combines both is_empty and matches_schema?