refactor(eval): unify MatchResult and CorrelationResult into a single EvaluationResult

[mostafa]

Summary

Collapses the two parallel result types (MatchResult and CorrelationResult) into a single EvaluationResult built from a shared RuleHeader plus an #[serde(untagged)] ResultBody enum. The five fields that are shared today (rule_title, rule_id, level, tags, custom_attributes) live in RuleHeader along with a new optional enrichments map; the kind-specific fields stay in DetectionBody / CorrelationBody.

ProcessResult becomes a Vec<EvaluationResult> (detections first, correlations after, in evaluation order). The three duplicated sink loops in file.rs, stdout.rs, and nats_sink.rs collapse to one. A new ProcessResultExt extension trait gives call sites readable detections() / correlations() / detection_count() / correlation_count() views without forcing pattern matching.

Wire shape

NDJSON output keeps the same field set, same values, and same skip_serializing_if behavior. Both the header and the body flatten into the parent JSON object via #[serde(flatten)], so each line stays a single flat object. Downstream consumers continue to distinguish detection from correlation by the presence of correlation_type.

One cosmetic change: on rules with a non-empty custom_attributes map, custom_attributes is now emitted between the rule header fields and the kind-specific body fields rather than at the end of the line. JSON objects are unordered per spec, so this is invisible to compliant consumers. The new golden snapshot tests at crates/rsigma-eval/tests/wire_shape_golden.rs pin the new ordering for both kinds (with and without custom_attributes / enrichments).

Library API (breaking, pre-1.0)

Before	After
m.rule_title, m.tags, ...	m.header.rule_title, m.header.tags, ...
m.matched_fields, m.event	m.as_detection().unwrap().matched_fields, .event
m.correlation_type, m.group_key, ...	m.as_correlation().unwrap().correlation_type, ...
result.detections.len()	result.detection_count()
result.correlations.iter()	result.correlations()
result.detections[0]	result.detections().next().unwrap()

Performance

A new Criterion bench at crates/rsigma-eval/benches/result_serialize.rs compares the new design's serialize throughput against a byte-for-byte copy of the old flat structs across four representative inputs (small/realistic, detection/correlation). The new design is within +/-4% of the baseline on every sample; the bench's equivalence preflight also asserts byte-identical wire shape across the two layouts on the sample inputs.

Test plan

• cargo test --workspace --all-features (1341 tests pass)
• cargo fmt --all -- --check clean
• cargo clippy --workspace --all-targets --all-features -- -D warnings clean
• cargo bench --bench result_serialize (within +/-4% of baseline on every sample; equivalence preflight passes)
• Golden NDJSON snapshot tests for detection and correlation lines, including the non-empty custom_attributes case (crates/rsigma-eval/tests/wire_shape_golden.rs)