reuse existing sketch if name is given

[cvandeplas]

What existing problem does this PR solve?

timesketch_importer.py recreates new sketches when a sketch_name is given, instead of reusing the existing sketch.

What new feature is being introduced with this PR?

Reuse of an existing sketch when a name is given. If the sketch does not exist, create a new one with that name (original behaviour).

This is a reworked version of #3626, addressing all review feedback from @jkppr and @jaegeral.

Changes

• api_client/python/timesketch_api_client/client.py: Added get_sketches_by_name() method to the TimesketchApi class, returning a list of matching sketches. Conflict resolution (duplicates) is the caller'''s responsibility.
• api_client/python/timesketch_api_client/sketch.py: Added created_at and creator properties to the Sketch class.
• importer_client/python/tools/timesketch_importer.py: Uses the new API method and adds a --sketch-strategy flag (ask/newest/oldest) to handle duplicate sketch names.
• docs/guides/user/upload-data.md: Documented the new --sketch-name and --sketch-strategy flags.

Design decisions

• Sketch lookup lives in the API client, not the importer. Per review feedback, get_sketches_by_name() is a generic operation useful beyond the importer, so it belongs in TimesketchApi.
• Returns a list, not a single sketch. Sketch names are not unique. The method returns all matches and raises KeyError if none are found. Callers decide how to resolve duplicates.
• Case-sensitive matching. Exact name match avoids accidental collisions (e.g. "Case-A" vs "case-a").
• --sketch-strategy flag for automation. In interactive mode (default ask), the user is prompted to select. For automated pipelines, newest or oldest can be passed to avoid interactive prompts.

Checks

• All tests succeed
• Unit tests added (get_sketches_by_name, created_at, creator, duplicate handling, case sensitivity)
• e2e tests added
• Documentation updated

Closing issues

closes #3625

[jkppr]

Thanks for the contribution and following up on the earlier PR. This is the first round of review.

[jkppr]

Please also ensure pylint & black are happy. You can run this in your dev setup:

docker exec -it -w /usr/local/src/timesketch timesketch-dev black <files you changed>

docker exec -it -w /usr/local/src/timesketch timesketch-dev pylint --rcfile=.pylintrc <files you changed>

[cvandeplas]

Thanks @jkppr for the input. I think I've incorporated it in this update.

[jaegeral]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces the ability to target sketches by name in the Timesketch importer client, including handling duplicate sketch names through various strategies (newest, oldest, or interactive selection). It adds supporting client API methods, properties (created_at, creator), tests, and documentation. The review feedback recommends restricting the --sketch-strategy argument using argparse choices, adhering to the style guide by using f-strings instead of .format(), and improving the robustness of the interactive CLI prompt by validating user-selected sketch IDs.

[cvandeplas]

linting fixed