Allow syslog threshold to check current and past events to trigger alert

[bmfmancini]

The current syslog threshold setup only looks at the messages in the syslog_incoming table
this only allows for syslog to check logs that have been sent in the interveral of the syslog poller

for example on a 1 minute polling cycle with a syslog threshold set to 10 the device would have to send the same log 10 times in that minute for the threshold to fire

It would be better to check the saved syslog data to see if the threshold has been breached
it would be nice to have a timeframe option say x messages in x minutes/days etc similar to what we have in the thold plugin

[TheWitness]

That could be expensive, but with partitioned tables on a date range, is should be okay.