work through "Q: ..." KQL compat questions in kqlog/rpn.go

[trentm]

There are a number of type-comparison questions in kqlog/rpn.go that should eventually be worked through. They will show up as log statements from ecslog ... if the ECSLOG_DEBUG=1 environment variable is set and if the KQL filter and filtered log records hit the particular case. I expect these to be rare cases in practice.