Remove libpcap dependency and add Windows support

[andrewkroh]

Proposed commit message

Remove libpcap dependency and add Windows support

stream needed libpcap and cgo solely to read capture files offline, so
`go install github.com/elastic/stream@latest` failed on any machine
without libpcap and a C toolchain. Windows was hit hardest because Go
disables cgo there by default.

Replace pcap.OpenOffline with gopacket's pure Go pcapgo readers,
dispatching on the file magic to choose the pcap or pcapng reader and
decompressing gzipped captures explicitly. stream now builds with
CGO_ENABLED=0 everywhere, so libpcap is gone from the Dockerfile, the
Buildkite pipeline, and the GitHub workflows.

Windows also failed to compile because root.go used unix.SignalNum.
Move the signal name lookup behind a build tag: Unix keeps the full
set, while Windows recognizes SIGINT and SIGTERM, the only signals the
Go runtime emulates there.

Read packets in an explicit loop instead of PacketSource.Packets(),
which retries unrecognized errors in a 5ms loop and so would hang
stream indefinitely on a corrupt capture. Truncated captures are still
tolerated with a warning.

Build the published image FROM scratch now that the binary is static,
copying only the CA bundle from the builder. This drops the image from
70.5MB to 56.6MB.

Add a cross-build workflow covering six platforms plus ubuntu, windows
and macos test runs so none of this regresses unnoticed.

Validated by diffing old and new payload extraction across 55 capture
files against libpcap 1.10.5: classic pcap matches byte for byte, and
no file that libpcap could read fails with pcapgo.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 80b225f