if an IP-timewindow pair are responsible for most of the traffic, then their traffic will be handled by one timewindow only because of the lock.

[AlyaGomaa]

in #2063

• also then, if another worker gets a related profile/tw flow from the queue, they wait indefinetely to acquire it.
  thats reducing the use of parallelization and slowing down evidence processing.

[AlyaGomaa]

even moving the lock to only the score manipulation section introduced performance issues.
most hosts have a single ip dominating the traffic for the entire tw, im gonna find a way to handle this alert duplication other than the one implemented now.

[AlyaGomaa]

fixed by using "claims", simply keys in the db that are held by the worker generating an alert so no other worker can generate a duplicate alert.