test: SigmaHQ corpus regression for dynamic pipelines

[mostafa]

Summary

• Add 5 dynamic pipeline fixture files with file-based sources (no network required in CI) covering: field mapping extraction, allowlists, multi-format sources (JSON/YAML/CSV/lines), all three extract languages (jq/JSONPath/CEL), and include expansion.
• Extend the sigma-corpus CI job with two new regression steps:
  1. Validate the full SigmaHQ ruleset with all dynamic pipelines applied (--resolve-sources)
  2. Golden file comparison: run rsigma resolve on each fixture and diff against committed expected output
• Source data files and golden output committed for reproducibility.

Fixture coverage

Pipeline	Sources	Extract	Formats
field_mapping	1 file	jq	JSON
allowlist	2 files	jq	JSON, lines
multi_format	4 files	none	JSON, YAML, CSV, lines
extract_languages	3 files	jq, JSONPath, CEL	JSON
include_expansion	1 file	none	JSON (transformation array)

Test plan

• rsigma validate with all 5 dynamic pipelines passes locally
• rsigma resolve golden file comparison passes locally (all 5 match)
• CI sigma-corpus job passes with new steps