Task #5645: tracking: elephant flow detection
eve.flow: add thread id(s) processing a flow to the record
Log which thread id handled a flow. Can be 2 when in IPS mode, so should probably be an array of id's.
Open question: should we track all thread id's in case of the wrong thread issue? See #2725.