Add NirSoft_USBDriveLog module

[Gear-I]

Description

Adds a new KAPE module, NirSoft_USBDriveLog, which parses the
Microsoft-Windows-Partition/Diagnostic and
Microsoft-Windows-Storsvc/Diagnostic event log channels (on by default
on Windows 10/11) into a plug/unplug history for USB storage devices,
using Nirsoft's USBDriveLog.exe.

Sourced from the maintainers' own "NirSoft Module To Do List" (the
usb_drive_log.html item). This is a different artifact from the
existing USBDeview module: USBDeview lists devices that have ever been
connected to the system (a historical inventory), while USBDriveLog is a
timestamped log of individual plug/unplug events - when a specific
device was connected and disconnected, not just that it was connected at
some point. Both have real, complementary evidentiary value.

Verified directly against NirSoft's own documentation that the tool's
offline "external folder" data source (for loading an already-collected
copy of the event logs) is GUI-only - accessed via the "Choose Data
Source" window (F7), no command-line switch exposes it. Same pattern
already hit with RecentFilesView's "external source" loading. So this is
Category: LiveResponse, matching the shape of the existing
TaskSchedulerView/ExecutedProgramsList/RecentFilesView/MyLastSearch
modules.

Requires Windows 10/11, since the two source event log channels don't
exist on earlier versions.

Testing

1. Plugged a real USB storage device into the test machine to generate
   a fresh, verifiable event.
2. Ran the module live: .\kape.exe --msource C: --mdest <output> --module NirSoft_USBDriveLog --debug
3. Verified the output CSV:
   • 187 real plug/unplug records, spanning 14 distinct devices (a
     SanDisk Cruzer Fit flash drive, external HGST hard drives, etc.).
   • Genuine historical data going back to January 2025 - real
     pre-existing evidentiary value, not just the manufactured test
     event.
   • The most recent row is the freshly plugged-in test device, timestamped
     correctly with no Unplug Time yet recorded - confirming it captured
     the live event mid-connection.

Checklist:

Please replace every instance of [ ] with [X] OR click on the checkboxes after you submit your PR

• I have generated a unique GUID for my Target(s)/Module(s)
• I have placed the Target(s)/Module(s) in an appropriate subfolder in Targets or Modules. If one doesn't exist, I have either added it to the Misc folder or created a relevant subfolder with justification
• I have set or updated the version of my Target(s)/Module(s)
• I have verified that KAPE parses the Target(s)/Module(s) successfully via kape.exe, using --tlist/--mlist and corrected any errors
• I have validated my Target(s)/Module(s) against test data and verified they are working as intended
• I have made an attempt to document the artifacts within the Target(s) or Module(s) I am submitting. If documentation doesn't exist, I have placed N/A underneath the Documentation header
• For Targets, I have consulted either the Target Guide, Target Template, Compound Target Guide, or Compound Target Template to ensure my Target(s) follow the same format
• For Modules, I have consulted either the Module Guide, Module Template, Compound Module Guide, or Compound Module Template to ensure my Module(s) follow the same format