Prepare for EQL Correlations

[Mat0vu]

Hi,
I´ve discovered another small prerequisite for the implementation of EQL correlations (SigmaHQ/pySigma-backend-elasticsearch#121)

The correlation template that I´ve come up with currently looks like this

default_correlation_query: ClassVar[str] = {
        "sequence": "sequence {groupby} with maxspan={timespan} \n {search} {aggregate} {condition}",
}

As the {groupby} is needed outside from the {aggregate}, I´ve added it to the convert_correlation_rule_from_template just like the timespan parameter before, because I have not found a better way to do it...

[Mat0vu]

In my fork all tests were successful, the failed tests look like there was a temporary network issue, however I cannot find the option to rerun actions within this PR...