fix: Modify principal

[babyhuey]

I've modified the __user_email method to handle more cases where user identity information might be present in the CloudTrail event. The new code will:

• First check if there's a userIdentity field at all
• Try to get the email from principalId if it exists (common in IAM role cases)
• Try to get the email from userName if it exists
• Try to get the email from the arn field if it exists
• As a last resort, try to find an email in the entire userIdentity object
• Return "Unknown" only if none of the above methods work

This should help capture more user identities and reduce the number of "Unknown" principals in notifications. The code will now handle various ways that AWS might represent user identity in CloudTrail events, including:

• IAM users with email addresses
• IAM roles with assumed role sessions
• Federated users
• AWS service principals

[babyhuey]

Any chance of this getting looked at anytime soon?