profiler: no API handler emits mem_free or module_load events #515

The report schema has MemFreeEvent and ModuleLoadEvent, and record_process_event can build a MemFreeEvent, but no handler passes EventType.MEM_FREE or EventType.MODULE_LOAD. No profiler method builds a ModuleLoadEvent. A sample that calls VirtualFree on a buffer from VirtualAlloc, or LoadLibraryA("wininet.dll"), gets a mem_alloc event and no mem_free or module_load event.

speakeasy/winenv/api/usermode/kernel32.py#L1767-L1789

    @apihook("VirtualFree", argc=3)
    def VirtualFree(self, emu: "Win32Emulator", argv: list[int], ctx: api.ApiContext = api.NO_CONTEXT):
        """
        BOOL VirtualFree(
            LPVOID lpAddress,
            SIZE_T dwSize,
            DWORD dwFreeType
        );
        """
        rv = 0

        lpAddress, dwSize, dwFreeType = argv
        maps = emu.get_mem_maps()
        for m in maps:
            if m.base == lpAddress:
                m.free = True
                emu.clear_guard_pages(m.base, dwSize or m.size)
                rv = True
                break

        rv = 1

        return rv

speakeasy/windows/winemu.py#L3591-L3624

VirtualFree is the only free handler. speakeasy has no handler for VirtualFreeEx, NtFreeVirtualMemory or ZwFreeVirtualMemory. VirtualFree can call self.record_process_event(emu.get_current_process(), EventType.MEM_FREE, base=lpAddress, size=dwSize or m.size) when it finds the map, in the same way that VirtualAlloc records MEM_ALLOC. LoadLibrary, LoadLibraryEx and LdrLoadDll all call emu.load_library, so load_library can emit MODULE_LOAD for each module that is not in original_modules, which also gives the dependencies that the load maps. This needs a new profiler method, because ModuleLoadEvent has no pid and record_process_event does not accept MODULE_LOAD. If these events are not wanted, remove the two event types from AnyEvent and from the schema.

doc/reporting.md and doc/migrating-to-2.0.md (#498) say that Speakeasy does not set these events. Update them with the fix.