Map the filtered es-python events as sources, files and the sinks they reached

Takes the SAME body as /api/get_all_events_with_count/, with view python, and returns the whole filtered set aggregated into a graph instead of a page of rows. This is what the events page's Map layout draws. Every event is counted under the source category the sources filter would select it with (socket, file, stdin, env, argv, manual, fuzzer, foreign, or other for an origin none of those claim), under the file it was read from when that source is file, and under its sink (the where field). sources, files and sinks list each of those, and links lists every source, file and sink path; each entry carries events (stored events), hits (the occurrences those events coalesce) and severity (the worst among them), worst first. file is empty on a link whose source is not file, and a file path is empty for a file read through a descriptor that named no path. Only what the filtered events contain appears: with no socket events there is no socket source. The filters, the monthly per-view quota, the suppression bucket and the impact-tag predicate mean exactly what they mean on the events page. Add any of source, file and sink as query parameters to also receive focus.events, the newest 200 matching events as list rows in the same 17-element shape as /api/get_all_events_with_count/, with focus.truncated set when there were more; the aggregate is never narrowed by them. A present but empty file selects the descriptor with no path. Add only=focus with a focus to receive just {"focus": ...} when you already hold the graph; a focus request is answered from the map most recently built for the same body, and its events are read fresh, so one that no longer matches the filter is left out. The map covers every event the filter selects, so truncated is false. Any view other than python is a 400.

This is a read: a read-only API key may call it.