[Backport 2.x] Sigma Aggregation rule fixes

[opensearch-trigger-bot]

Backport b838dd8 from #622

[codecov]

Codecov Report

Merging #639 (8baa9f7) into 2.x (f20bada) will increase coverage by 0.03%.
Report is 1 commits behind head on 2.x.
The diff coverage is 62.50%.

@@             Coverage Diff              @@
##                2.x     #639      +/-   ##
============================================
+ Coverage     25.02%   25.06%   +0.03%     
- Complexity      940      941       +1     
============================================
  Files           255      255              
  Lines         11127    11144      +17     
  Branches       1243     1247       +4     
============================================
+ Hits           2785     2793       +8     
- Misses         8090     8097       +7     
- Partials        252      254       +2     

Files	Coverage Δ
...ecurityanalytics/rules/backend/OSQueryBackend.java	66.81% <100.00%> (ø)
.../securityanalytics/rules/backend/QueryBackend.java	64.54% <100.00%> (+0.32%)	⬆️
...curityanalytics/rules/objects/SigmaDetections.java	100.00% <100.00%> (ø)
...a/org/opensearch/securityanalytics/model/Rule.java	0.00% <0.00%> (ø)
...tyanalytics/rules/aggregation/AggregationItem.java	94.73% <66.66%> (-5.27%)	⬇️
...opensearch/securityanalytics/util/RuleIndices.java	0.00% <0.00%> (ø)
...ch/securityanalytics/findings/FindingsService.java	35.89% <50.00%> (-0.59%)	⬇️
...lytics/transport/TransportIndexDetectorAction.java	0.00% <0.00%> (ø)

... and 2 files with indirect coverage changes