feat(convert): add CTE-based correlation pre-filtering and sliding window format

[mostafa]

Summary

Inspired by the pySigma Athena backend, this PR adds two correlation improvements to the PostgreSQL backend:

• CTE-based pre-filtering: non-temporal correlation types (event_count, value_count, value_sum, value_avg, etc.) now wrap referenced rules' queries in a WITH combined_events AS (q1 UNION ALL q2 ...) CTE. The aggregate reads from combined_events instead of scanning the entire table unfiltered. When no per-rule queries are available (standalone correlation rules), the backend falls back to the previous full-table scan with time filter.

• sliding_window output format: a new output format for event_count correlations that uses SQL window functions instead of GROUP BY + HAVING. It produces a per-row sliding window that emits every event crossing the threshold within its trailing window:

  WITH combined_events AS (...),
  event_counts AS (
      SELECT *, COUNT(*) OVER (
          PARTITION BY group_by ORDER BY time
          RANGE BETWEEN INTERVAL 'N' SECOND PRECEDING AND CURRENT ROW
      ) AS correlation_event_count
      FROM combined_events
  )
  SELECT * FROM event_counts WHERE correlation_event_count >= threshold

  The existing GROUP BY + HAVING approach remains the default format.

Also includes:

• README updates: both root and rsigma-convert READMEs updated with new output format, SELECT column selection, CLI backend options, CTE pre-filtering, and sliding window correlation documentation.
• CI paths-ignore: ci.yml now skips runs for markdown, docs, assets, LICENSE, and .gitignore changes.

Test plan

• 4 new unit tests for CTE pre-filtering (event_count with CTE, multi-rule UNION ALL, fallback without queries, value_count with CTE)
• 4 new unit tests for sliding window (with CTE, without CTE, no group-by, default format unchanged)
• All 72 unit tests pass
• All 11 golden tests pass
• cargo fmt --all -- --check passes
• cargo clippy --workspace --all-targets --all-features -- -D warnings passes