Show all events when matching/filtering

[seanvaleo]

Default behavior is to show the last 20 events with scope events unless --all is explicitly specified.

To improve user experience, when we specify one of --source, --sourcetype, --match or --eval we should show all matches by default, not a limit of 20. This avoids confusion, where the user might expect more matches for their query.

It should still be possible to display a subset of results with the --last option if that is desired.

[seanvaleo]

QA INSTRUCTIONS

Part 1
Do:

docker run --rm -it cribl/scope:<VERSION_ID>
apt update
scope run -- apt install curl -y
scope events
scope events --match fs
scope events --source fs.close
scope events --sourcetype fs
# etc...

Expect:
You see only 20 events with no matching/filtering arguments.
You see more than 20 events with matching/filtering arguments.

[jrcheli]

I bugathoned this with v1.0.2-rc0 on 10-Mar-2022. Looks great!