FR: Add correlation rules to the Sigma engine

[scudette]

A full description of correlations is found here https://open.substack.com/pub/ecapuano/p/atomic-and-stateful-detection-rules

[mgreen27]

https://sigmahq.io/docs/meta/correlations.html

Reading the sigma spec - there doesnt look like too many options for stateful process detections that we can do in vql wrt heirarchy