add toggle_callbacks support

[evilele]

New Features

• only toggle EDRProcessAndThreadObjectsCallbacks to methodically disable/restore (process handle) EDR protections
  EDRSandblast.exe toggle_callbacks 0|1|0e1|0t1 --kernelmode -i

Reason

• MsMpEng.exe (Windows 11 24H2, Defender for Individuals) downgrades any OpenProcess handles, even when running as PPL
  • h = OpenProcess(PROCESS_ALL_ACCESS, FALSE, <pid>); h.GrantedAccess --> 0x1ff7d4

• but now after disabling the relevant callback we have full access

• after the relevant actions are completed, the callback can be restored and Defender should work as expected