Add separate file output for converted rules with directory structure preservation

[Copilot]

Converting multiple Sigma rules currently outputs all results to a single file, making version control and selective deployment impractical. This adds support for writing each converted rule to a separate file with configurable naming and directory structure.

Changes

• New --output-dir parameter: Specifies output directory for individual rule files (mutually exclusive with --output)
• New --output-filename-template parameter: Controls output filenames using template variables:
  • {path}: Relative source directory path
  • {stem}: Source filename without extension
  • {index}: Query index for rules emitting multiple queries (1, 2, 3...)
• Per-rule conversion: Rules are now converted individually when using --output-dir, allowing granular output control
• Automatic directory creation: Output directories are created as needed based on template
• Correlation rule validation: Added validation to prevent use of --output-dir with correlation rules, which reference other rules and must be converted as part of the full collection. Exits with clear error message directing users to use --output instead.
• Filter support: Filters are fully supported with --output-dir as they are resolved at collection load time and baked into individual rule detections

Usage

# Flat structure - all converted files in one directory
sigma convert -t esql -p ecs_windows --output-dir translated/ rules/

# Preserve source directory structure
sigma convert -t esql -p ecs_windows \
  --output-dir translated/ \
  --output-filename-template "{path}/{stem}.esql" rules/

# Handle multi-query rules with indexed filenames
sigma convert -t esql -p ecs_windows \
  --output-dir translated/ \
  --output-filename-template "{stem}-{index}.esql" rules/

Given source structure:

rules/
├── windows/rule_1.yml
├── linux/rule_2.yml

Template {path}/{stem}.esql produces:

translated/
├── windows/rule_1.esql
├── linux/rule_2.esql

Limitations

• Correlation rules are not supported with --output-dir. Correlation rules reference other rules by name and require the full collection context for conversion. Use --output to write correlation rules to a single file.
• Filters work correctly with --output-dir and are applied to individual rules as expected.

Testing

• Added comprehensive tests for correlation rule validation
• Added tests for filter support with --output-dir
• All existing tests pass