dsl: relative event fields as values

[banditopazzo]

We should introduce support for use relative event fields as values. I wanted a rule to detect the suspicious action of an executable deleting itself from the filesystem, example:

- name: Executable delete itself
  type: FileDeleted
  condition: payload.filename == header.image

At the current state is not possible to create this type of rules, because the argument of the condition need to be static.