Roblox law enforcement return parser

[abrignoni]

Adds a Roblox return parser as scripts/artifacts/robloxReturns.py with 15 artifacts under the Roblox Returns category:

• IP addresses, chat records, messages, friend list, follower and following list, group wall posts, device information, device IDs, browser tracker ID, ad IDs
• User generated content master list, plus delivered UGC asset files with inline image media
• Support tickets and ticket comments (Zendesk ticket export JSON), including the per-comment IP and location metadata those exports carry
• The delivered account PDFs embedded as viewable documents

Mapped and validated against a private law enforcement return, so there are no sample_data keys on purpose. Column mappings and date orders are sourced in the artifact notes: the Messages CSV carries human and epoch timestamps that agree on every row, which pins the month-first order used across the delivery, and the follower list epoch milliseconds unit is labeled as inferred from the value range.

Delivery quirks the parser handles, all observed in one return:

• zips nested inside zips; the tool does not expand those, so the notes say to run against a fully decompressed folder with -t fs
• the same asset metadata delivered in two header layouts (a compact assetid layout and a richer id layout); records are merged and the richer fields kept where delivered
• five different timestamp encodings across the CSVs of a single return
• chat rows grouped by conversation with empty separator rows between groups, and a reduced row variant carrying only a subset of columns
• the master list asset_hash_id is an internal id, not the content hash that names the delivered files; the linkage is documented in the notes

A full RLEAPP run against the return matched independently derived record counts on all 15 artifacts. Lint, claim language, and HTML safety gates pass locally.