Support `contains|all` field

[YamatoSecurity]

In Sigma rules, the following declaration is often used:

selection:
    ImagePath|contains|all:
        - 'ADMIN$'
        - '.exe'

However, to use it in Hayabusa, it needs written in the following way:

selection:
    ImagePath|contains: 'ADMIN$'
    ImagePath|contains: '.exe'

Many users request more compatibility with sigma rules so I would like to support this way of writing as well as it is more commonly used in sigma and it makes rules easier to read.

[hitenkoku]

@YamatoSecurity Basically, I am thinking of the principle of OR conditions for anything written in the form of an array. Wouldn't that be confusing if the "and" condition is used only when "all" is added?

[YamatoSecurity]

@hitenkoku YAML lists are written with - and have OR logic so might be confusing for those not familiar with sigma. In sigma rules, contains|all makes them AND logic. That is how everyone writes sigma rules so I don't think it will be confusing if explained.