Consider reusing instances of CorrelationSearch across multiple tests for the same detection

[cmcginley-splunk]

• Right now, we are creating one CorrelationSearch instance for each case
• Typically, there is only one unit test, and thus one integration test, per detection, so this is not an issue.
• However, if we start having many test cases per detection, we will be duplicating some effort & network calls that we don't need to.
• Consider refactoring in order to re-use CorrelationSearch objects across tests in such a case