Support unwrapping arrays

[davidkarlsen]

output (kafkarecords) from azure-diagnostic settings over azure event hubs is on format:
https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/stream-monitoring-data-event-hubs#data-formats

{
  "records": [
    {...},
    {....},
]}

I'd like to unwrap this structure into splunk, so that each individual record is fed into splunk - not the array struct.

Then the shipping could be a simple sink, and not a custom stream to unwrap, and then into the splunk sink.