feat(eval): batch large |contains lists into Aho-Corasick automaton

[mostafa]

Summary

When a detection item or keyword group has 8+ plain |contains needles with the same case sensitivity, the compiler now collapses them into a single AhoCorasickSet matcher. This replaces N sequential str::contains calls with one linear pass over the haystack.

The optimizer is invoked only on AnyOf (OR) construction sites; AllOf (|all modifier) is left untouched so AND semantics are preserved.

For case-insensitive matching, needles are pre-lowered (matching the existing Contains invariant) and the hot path lowers the haystack once via a new ascii_lowercase_cow helper with a 3-tier fast path: borrow when already lowercase ASCII, in-place make_ascii_lowercase for ASCII with uppercase, full Unicode to_lowercase only for non-ASCII input.

Changes

• New aho-corasick = "1" direct dep (already transitive via regex).
• New CompiledMatcher::AhoCorasickSet { automaton, case_insensitive } variant.
• New compiler/optimizer.rs module with optimize_any_of partition+bucket implementation. Threshold: 8 (placeholder; refined by sweep benchmark).
• New matcher/helpers::ascii_lowercase_cow helper.
• New tests/regression_eval.rs with 3 snapshot tests (contains-heavy corpus, AllOf semantics safeguard, keyword AC path).
• New bench groups: eval_contains_heavy (5–200 patterns) and eval_ac_threshold_sweep (pattern count × haystack length cross-product).

Tests

• 7 unit tests for optimize_any_of (empty, singleton, below/at threshold, separate CI/CS buckets, mixed matchers, equivalence).
• Proptest ac_agrees_with_anyof_contains asserts the optimized matcher agrees with the unoptimized version on random haystacks.
• Proptests for ascii_lowercase_cow correctness vs std to_lowercase and the zero-alloc fast path.
• Regression test for the AllOf safeguard: a |contains|all rule must NOT fire on partial matches.

All 412 unit tests + 3 regression tests + workspace clippy clean.

Benchmarks (vs before-p1 baseline)

Group	Before	After	Change
eval_throughput/events/1000	388 K elem/s	404 K elem/s	+3.3%
eval_throughput/events/10000	389 K elem/s	406 K elem/s	+5.1%
eval_throughput/events/100000	386 K elem/s	405 K elem/s	+4.8%

New eval_contains_heavy (1 rule with N |contains needles, 1000 events):

Patterns	Throughput
10	7.25 Melem/s
20	8.68 Melem/s
50	10.32 Melem/s
100	10.40 Melem/s
200	7.25 Melem/s

The 50-100 sweet spot reflects AC's automaton-traversal cost balancing pattern count.

Test plan

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --workspace
• Criterion benchmarks before/after on eval_throughput and new eval_contains_heavy
• SigmaHQ corpus regression (run after merge)

Acknowledgements

This PR and the subsequent changes are inspired by this post about optimizing the pySigma-backend-spark with Aho-Corasick algorithm for contains modifiers in Spark by Jean-Claude Cote. Also, I'd like to thank Vinicius Morais who informed me about this.