Retain correlation context fields in Splunk stats output

[theluckydraco-stack]

Summary

Fixes #40.

pySigma already collects correlation fields from the correlation rule and its
referenced rules, deduplicates them, and excludes fields used by group-by.
This change makes the Splunk backend consume that generic {fields} value in
its aggregation templates.

Changes

• add {fields} to the Splunk event_count, value_count, temporal, and
  temporal_extended stats templates
• render retained fields as values(<field>) as <field>
• update the previous regression test that asserted context fields were discarded
• add coverage for deduplication, group-by exclusion, value-count correlations,
  and temporal correlations

Behaviour

A rule containing:

fields:
  - process_path
  - process_name