Fix `unified_log` handling of timestamp formats by Smjert · Pull Request #8451 · osquery/osquery

There's an additional problem I did not consider. When writing a constraint like timestamp > 123, the predicate passed to the unified log is actually timestamp 123.0 which then means that entries with timestamp 123.1, 123.2 and so on are for all intents and purposes higher than that, but then when casted back to an integer they are still 123.
So these will still get filtered by sqlite and at the same time count towards the default 100 rows returned limit.

The solution here is to actually pass the timestamp in the constraint + 1, if the constraint is using >. If it was any other logging system, a log message with time 123.1 would've had 123 as a timestamp.
The table has predicate that can be used to do more precise constraints in theory.