embedded pe: offsets are virtual addresses rather than file offsets

[williballenthin]

characteristic: embedded pe is a file-scoped feature, and therefore i think its intended that the associated address is a file offset.

pefile and viv backends extract file offsets correctly.

but IDA, Ghidra, and BN currently extract virtual addresses (and possibly mis-label them as file offsets.

[williballenthin]

via Codex

  - pefile.extract_file_embedded_pe() emits Characteristic("embedded pe") with a real
    FileOffsetAddress(offset) taken from carve_pe() scanning the raw buffer, so the integer
    truly is a file offset (deps/capa/capa/features/extractors/pefile.py:34-36).
  - The vivisect extractor follows the same pattern: offsets from viv’s carver are yielded
    as genuine file offsets (deps/capa/capa/features/extractors/viv/file.py:31-33).
  - IDA’s extractor wraps the EA returned by find_byte_sequence() as FileOffsetAddress(ea)
    without converting to a file offset, so despite the type tag the stored value is an
    absolute virtual address (deps/capa/capa/features/extractors/ida/file.py:88-90, deps/
    capa/capa/features/extractors/ida/helpers.py:19-70).
  - The Ghidra and Binary Ninja extractors do the same—block.getStart().getOffset()
    and seg.start + offset are virtual addresses, yet they are published as
    FileOffsetAddress(...) (deps/capa/capa/features/extractors/ghidra/file.py:83-92, deps/
    capa/capa/features/extractors/binja/file.py:46-55).