Add NirSoft_FullEventLogView_TerminalServices-RDPClient module

[Gear-I]

Description

Adds a new KAPE module, NirSoft_FullEventLogView_TerminalServices-RDPClient,
which parses the Microsoft-Windows-TerminalServices-RDPClient/Operational
event log using Nirsoft's FullEventLogView.exe. This follows the exact
same structure as the existing NirSoft_FullEventLogView_System,
_Security, _Application, etc. modules (author: Barrie Hill) same
Category (EventLogs), same FileMask/LogFolderWildcard pattern, same
offline-capable design.

This log records outbound RDP connection attempts made by this machine
as a client Event ID 1024 ("client is attempting to connect"), 1102
("client disconnected"), and related IDs — regardless of whether the
connection ever succeeded. That makes it standard DFIR evidence for
establishing what remote hosts a machine attempted to RDP into.

Testing

1. Generated a real outbound RDP connection attempt via mstsc targeting
   192.0.2.1 (a reserved, non-routable documentation address — the
   attempt itself is what's logged, not success).
2. Confirmed the resulting event in Event Viewer.
3. Staged the live .evtx file into a clean KAPE source folder
   (Windows\System32\winevt\Logs\).
4. Ran the module: .\kape.exe --msource <staged> --mdest <output> --module NirSoft_FullEventLogView_TerminalServices-RDPClient --debug
5. Verified the output CSV:
   • 1,792 data rows exported.
   • The exact test event present: Event ID 1024, "RDP ClientActiveX is
     trying to connect to the server (192.0.2.1)", followed by the
     expected disconnect/timeout sequence (Event IDs 1105, 226, 1026).
   • Genuine historical connection data present as well (back to
     5/23/2025), confirming this isn't just picking up the synthetic
     test event.
   • Confirmed the literal % character in the target filename
     (...RDPClient%4Operational.evtx) does not collide with KAPE's own
     %variable% template substitution — the Log File column in the
     output shows the correct, fully-resolved staged path.

Checklist:

Please replace every instance of [ ] with [X] OR click on the checkboxes after you submit your PR

• I have generated a unique GUID for my Target(s)/Module(s)
• I have placed the Target(s)/Module(s) in an appropriate subfolder in Targets or Modules. If one doesn't exist, I have either added it to the Misc folder or created a relevant subfolder with justification
• I have set or updated the version of my Target(s)/Module(s)
• I have verified that KAPE parses the Target(s)/Module(s) successfully via kape.exe, using --tlist/--mlist and corrected any errors
• I have validated my Target(s)/Module(s) against test data and verified they are working as intended
• I have made an attempt to document the artifacts within the Target(s) or Module(s) I am submitting. If documentation doesn't exist, I have placed N/A underneath the Documentation header
• For Targets, I have consulted either the Target Guide, Target Template, Compound Target Guide, or Compound Target Template to ensure my Target(s) follow the same format
• For Modules, I have consulted either the Module Guide, Module Template, Compound Module Guide, or Compound Module Template to ensure my Module(s) follow the same format