Try to improve markroot transform (used in `SqlStorage.cache()`): For cases where, e.g., there are 3 IPs in a single observation, we have to pick one as the "primary" (or "root"). So we'll keep an ordered list of objects we see per type, in order of preference. Default is first-seen, but for some cases, like when a network-traffic object is present, we can use the object references to order our preferences: src_ref before dst_ref.
The main benefit of this scheme is when reconstructing the complete observation: if you LEFT OUTER JOIN by observation ID, you would get duplicates due to "fan out". Adding a WHERE clause for "x_root" IS NOT NULL will hopefully solve this.