Improve documentation about metrics and traces

[SecSamDev]

I have added information about some of the unknown fields that existed in both metrics and traces since they were correlated.
The most important field added are the flags that allow us to know if a block was loaded into executable memory, as a resource or brought from the "cache" (prefetched) or from disk.

Reference: James Habben post in 4n6ir

[joachimmetz]

@SecSamDev thanks I'll have a look when time permits. Was not aware of this blog post.

[SecSamDev]

I have checked it with different prefetch files from different Windows and the information matches perfectly. This is easily seen when dependencies are loaded as resources, since they are not loaded into executable memory areas and the resource flag is set.