Add Slack Workspaces and Client Sessions Artifacts for Windows

[Gear-I]

Summary

Adds two new artifacts for Slack desktop's Local Storage LevelDB
(Local Storage/leveldb), following the existing Discord/Wire Local
Storage artifact conventions:

• Slack Workspaces (slackWorkspaces) — parses the localConfig_v2
  key into one row per signed-in workspace: team ID, name, URL,
  per-workspace user ID, most-recently-used and version timestamps,
  last-viewed channel/DM ID, and a masked session token.
• Slack Client Sessions (slackSessions) — parses
  activitySession_<teamId> keys into a usage timeline: session
  start, last-activity, and last-logged times, plus a computed
  duration.

Local Storage does not hold Slack message content (that lives in
IndexedDB), so these focus on what it does reliably hold: workspace
enumeration and usage/session timing, independent of message content.

Design notes

• Because Local Storage is a LevelDB, superseded versions of a key
  are preserved on disk. Both artifacts read all recoverable versions
  (not just the live/current one), so a workspace that was later
  removed, or an earlier session, still shows up.
• Session tokens (xoxc-/xoxb-/xoxp-/xoxs-/xoxr-/xoxd-
  prefixed) are masked to the first 8 and last 4 characters — a full
  token is a live credential, not a normal artifact value.
• Cosmetic localConfig_v2 fields (theme colors, sidebar gradients)
  are filtered out of the "Other Fields" column; anything else Slack
  stores per-team is preserved there since it varies by client
  version.
• Both modules are standalone — no shared helper file, no import
  dependencies beyond the existing scripts.chromium.local_storage
  reader already used by Discord/Wire.

Testing

Verified against a real multi-workspace Slack desktop profile
(Slack 4.51.180.0, Windows). Confirmed correct output for 3 real
workspaces and their usage sessions, including token masking and
timestamp conversion from both ISO 8601 and epoch formats. pylint
clean (10/10) on both files, no pylint: disable suppressions.

Sample data

Both artifacts declare a sample_data entry for corpus
slack_win_multiworkspace (Slack 4.51.180.0, Windows):

• slackWorkspaces: 5 rows
• slackSessions: 4 rows

[abrignoni]

Thanks for the contribution!

This PR changes artifact modules without test data for them. A small fixture with each artifact change lets reviewers run the module against real data, and the committed case keeps guarding the module after merge.

• SlackSession.py: please include a fixture with this PR.
• slackWorkspaces.py: please include a fixture with this PR.

Adding a fixture

Generate it from your extraction with the helper (details in create_module_test_cases.md):

python admin/test/scripts/make_case_data.py <module> --case <case_number> --input <extraction.zip>

It writes admin/test/cases/testdata.<module>.json and one zip per artifact under admin/test/cases/data/<module>/.

Size rules:

• Under 10 MB per zip: commit the files in this PR.
• 10 to 25 MB: commit the case JSON in the PR and attach the zip to a comment here.
• Over 25 MB: say so here and a maintainer will arrange a handoff.

If your extraction cannot be shared:

• If the app appears on a public research image, generate the fixture from that instead. public_corpus_images.md lists the images and where to download them.
• Or sanitize the real file in place: keep the file the app wrote and overwrite only the personal values, which keeps the format honest.
• Or script a known session: install the app on a test device with a throwaway account, perform documented actions, and extract that.

If none of those fit, say so here and we will work it out. The PR can still be reviewed and merged with the gap recorded in the artifact's notes.

This is a request, not a gate. Nothing here blocks review.

[Gear-I]

In the process of converting my personal data that I used to test this artifact parser into synthetic data, I will provide it once I have re-tested and made sure the output is the same.