fix: point the field maps at real ECS columns

[catinspace-au]

The four default field maps pointed at a short column vocabulary no meta schema defines. ClickHouse refuses a view when any one target is missing (code 47, UNKNOWN_IDENTIFIER), so every view built from these maps failed. Image went to the basename, so a full-path match could never fire.

• Sigma map is now the logsource-independent set dfe-schemagen (dfe-transform-elastic-dev, crates/dfe-schemagen/sigma-ecs-map.yaml) derives from pysigma-backend-elasticsearch 2.1.1, the pysigma <2 line. 121 entries, identical key for key.
• Every target is the ECS path with dots as underscores, which is how meta/elastic/ecs.yaml names all 1018 of its columns.
• Image, ParentImage, TargetFilename and ImageLoaded now resolve to full paths. EventID goes to event_code, TargetObject to registry_path.
• ECS, CIM and OCSF maps keep their keys and point at the same ECS columns. OCSF follows the pairing in Elastic's amazon_security_lake pipeline.
• Dropped from the Sigma default: CommandLine, User, LogonType, RegistryKey and RegistryValue. pySigma maps CommandLine and User to a different ECS field depending on the rule's logsource, so they need a source map. LogonType has no ECS field. RegistryKey and RegistryValue are not Sigma taxonomy fields and appear in no SigmaHQ rule.
• tests/test_field_maps.py checks every target of every map against timeseries + meta/elastic/ecs, and pins the Sigma fields whose wrong neighbour column also exists. It fails on main (10 failed) and passes here.

dfe-engine's tests/unit/test_fieldmap/test_registry.py pins the old Sigma map, so it needs editing in the same rollout that bumps dfe-schemas.

Closes #46

[github-actions]

Released in v0.2.9 -- https://github.com/hyperi-io/dfe-schemas/releases/tag/v0.2.9