artif: new artifacts to collect utmp and utmpdump results

[mnrkbys]

New artifacts to collect /var/run/utmp and results of utmpdump command. utmpdump command may help to detect tampered log files.

[tclahr]

Can we use last -f instead? I think last is more common than utmpdump no? I mean, last is available on most unix-like system. I am not sure about utmpdump.

Also, I was thinking about expanding this artifact to parse rotated (and compressed) utmp/wtmp/btmp files. Compressed ones could be read by zcat (if available on the target system).

Parsing those files would be useful in situations like AIX, where there are no parsers for utmp/wtmp/btmp out there, so UAC could use the built-in last to parse all available files.

I will work on it and commit to your PR.