Fix live matcher sighting post-processing

[dominiklohmann]

This contains a bunch of fixes for post-processing of live matcher fixes.

📝 Checklist

• All user-facing changes have changelog entries.
• The changes are reflected on docs.tenzir.com/threatbus, if necessary.
• The PR description contains instructions for the reviewer, if necessary.

🎯 Review Instructions

Commit-by-commit.

[lava]

We discussed this in a video call:

We cannot generate a valid STIX2 SDO with non-exact matcher, because we don't get the information about what was matched back from the matcher.

Long-term, the best solution for this case would probably be to create an Identity object for the matcher that can be specified in Sighting.where_sighted_refs and a Note object saying something like "Generated by VAST Non-Exact Matcher with ID XXX" in the sighting_of_refs field.

However, that's a somewhat bigger change, since we'd need to publish the identity and note objects before using them, so for now this should be an acceptable workaround until someone actually wants to consume results from non-exact matchers via threatbus.