Clarify Observed vs. Known Findings Bundles

[ikiril01]

We should consider adding the ability to specify whether a Findings Bundle, represents some set of data about a malware instance that was "observed" as part of an analysis run, or represents data that was derived or is otherwise "known". This mostly relevant to dynamic entities such as Actions and Behaviors, where currently this distinction is a little ambiguous (although implicit if a Findings Bundle is referenced in a corresponding Analysis).

[ikiril01]

Perhaps this isn't a useful distinction to make explicitly - I'm starting to think that having the implicit Analysis -> Action/Behavior link is enough to explain whether something was observed during a particular execution or is "known" or obtained through code analysis.

[ikiril01]

No longer relevant given #104.