[Backport 2.11] Sigma Aggregation rule fixes

[opensearch-trigger-bot]

Backport b838dd8 from #622

[codecov]

Codecov Report

Merging #640 (f186c5a) into 2.11 (c5882dc) will increase coverage by 0.06%.
The diff coverage is 62.50%.

@@             Coverage Diff              @@
##               2.11     #640      +/-   ##
============================================
+ Coverage     25.04%   25.10%   +0.06%     
- Complexity      940      945       +5     
============================================
  Files           255      255              
  Lines         11128    11144      +16     
  Branches       1243     1247       +4     
============================================
+ Hits           2787     2798      +11     
- Misses         8089     8094       +5     
  Partials        252      252              

Files	Coverage Δ
...ecurityanalytics/rules/backend/OSQueryBackend.java	66.81% <100.00%> (ø)
.../securityanalytics/rules/backend/QueryBackend.java	64.54% <100.00%> (+0.32%)	⬆️
...curityanalytics/rules/objects/SigmaDetections.java	100.00% <100.00%> (ø)
...a/org/opensearch/securityanalytics/model/Rule.java	0.00% <0.00%> (ø)
...tyanalytics/rules/aggregation/AggregationItem.java	94.73% <66.66%> (-5.27%)	⬇️
...opensearch/securityanalytics/util/RuleIndices.java	0.00% <0.00%> (ø)
...ch/securityanalytics/findings/FindingsService.java	35.89% <50.00%> (-0.59%)	⬇️
...lytics/transport/TransportIndexDetectorAction.java	0.00% <0.00%> (ø)

... and 1 file with indirect coverage changes