feat: Add UDM Search integration to logstory (Issue #27)

[dandye]

Description

Implements Option 1 from issue #27: extend logstory's ingestion pipeline to accept UDM search results directly from Chronicle, apply timestamp shifting, and replay them.

Changes

• New _search_udm() function to query Chronicle UDM Search API
• Extended _get_log_content() to support UDM queries as a data source
• Updated usecase_replay_logtype() to pass UDM parameters through
• New CLI command: replay from-udm-search <QUERY>
• Added UDM_EVENTS log type configuration with timestamp patterns
• Comprehensive unit tests for UDM search functionality

Usage Example

logstory replay from-udm-search "metadata.event_type='PROCESS_EXECUTION'" \
  --customer-id=YOUR_ID \
  --credentials-path=/path/to/credentials.json \
  --timestamp-delta=1d

Benefits

• Direct UDM search without needing pre-existing .log files
• Reuses existing timestamp replacement and ingestion pipeline
• Fully backward compatible with file-based replay
• Ingestion labels identify replayed events from UDM search

Documentation

• UDM_SEARCH_IMPLEMENTATION.md - Technical deep-dive
• UDM_SEARCH_QUICKSTART.md - User guide with examples

Fixes: #27

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.