Add Snare-via-syslog recipe to docs/windows-events.md

[azurebeard]

Context

docs/windows-events.md documents three Windows event ingest paths: NXLog Community Edition, Winlogbeat, and .evtx file replay. Snare (specifically Intersect Alliance Snare and its OSS counterpart Snare Enterprise OpenSource Agent) is another widely-deployed Windows-to-syslog agent that operators ask about.

Scope

Add a fourth section to docs/windows-events.md (call it ## Snare) covering:

1. What Snare emits — RFC 3164 syslog with Windows event data inline. Typical format is MSWinEventLog\t1\tSecurity\t12345\tDay Mon DD HH:MM:SS YYYY\t4624\tMicrosoft-Windows-Security-Auditing\tN/A\t... (tab-separated; check the Snare docs for the canonical schema).
2. Recommended Snare config — facility, severity, hostname formatting, syslog destination pointing at the Harbinger listener.
3. What Harbinger will and won't extract — Snare's tab-separated format isn't JSON-over-syslog, so harbinger.windows.try_extract() won't populate SyslogEvent.windows automatically. Document this honestly; explain that the classifier still labels the events sensibly via the log_type field even without the structured Windows breakdown.

Stretch (optional)

Open a follow-up issue to add Snare format detection to harbinger/windows.py so the Windows breakdown table populates for Snare-sourced events too. Not part of this issue's scope.

Acceptance criteria

• New ## Snare section in docs/windows-events.md with config snippet and operator notes.
• Snare added to the comparison table at the top of the doc (or wherever the existing three agents are compared).
• Honest "what won't work without code changes" note.

Why this is a good first issue

Pure documentation. Touches one file. Demonstrates Harbinger's transport-agnostic ingest design.