feat: implement pySigma parity gaps

[mostafa]

Summary

Close all 8 pySigma parity gaps in correlation and filter rule handling. The work is split into two phases.

Phase 0: Structural additions (no behavioral change)

• Add Correlation variant to RelationType enum and linter's VALID_RELATED_TYPES
• Add related, license, fields, scope to CorrelationRule struct, parser, and KNOWN_KEYS_CORRELATION
• Add 10 missing SigmaRuleBase fields to FilterRule with standard_filter_keys exclusion from custom_attributes
• Widen CorrelationCondition::Threshold.field from Option<String> to Option<Vec<String>>, propagated through parser, CompiledCondition, correlation engine, pipeline field mapping, and Postgres backend
• Add percentile: Option<u64> to CorrelationCondition::Threshold, used in ValuePercentile eval and Postgres PERCENTILE_CONT() generation

Phase 1: Behavioral fixes

• Introduce FilterRuleTarget enum (Any/Specific). rules: any, rules: [], and omitted rules all map to Any
• Replace symmetric logsource_compatible with asymmetric filter_logsource_contains for filter-to-rule matching
• Use the filter's own condition expression via rewrite_condition_identifiers instead of hardcoding AND NOT. Exclusion filters now require condition: not selection in YAML, matching pySigma semantics

Lint fixup: Update filter.rules validation to accept all valid forms (omitted, empty, "any", single string, sequence) and only error on invalid types.

Breaking change

Filter rules that previously used condition: selection for exclusion now need condition: not selection. The old behavior silently hardcoded AND NOT regardless of the filter's condition expression. This was a bug: it ignored the filter's actual condition and prevented inclusion filters or multi-selection OR conditions from working.

Test plan

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --workspace (all 393 tests pass, including CLI integration tests)
• Sigma corpus regression: rsigma validate on SigmaHQ/sigma full ruleset
• Spot-check Postgres backend golden tests for correlation condition changes