jmespath rules should handle rsyslog CEE mode

[rtyler]

rsyslog conventionally requires a "CEE" cookie (no idea why/what) for log lines that are going to be JSON.

For example:

@cee: {"some" : "json"}

I think it makes sense to have an optional field on the jmespath rule that accommodates this and strips the @cee: off the String before deserializing.

[rtyler]

The use-case I had in mind has been invalidated by @xianwill 👏