[mostafa]

Stacked on #608; merge that first.

A keywords: detection with a YAML boolean (keywords: [true]) parsed, compiled, and passed lint, but never fired. Keyword lowering turned the value into IrMatcher::BoolEq, and keyword evaluation runs only string matchers, which return false for it. backend convert rejected the same rule with UnsupportedKeyword, so eval was silently dead while convert errored.

Fix

Sigma keywords are strings, so keyword lowering now turns a boolean into a case-insensitive Contains of the word true or false, like any other keyword value. This fixes eval and convert together, and raising round-trips the keyword as the string 'true'.

Keyword search still does not visit JSON booleans: the three event walkers (including the one the candidate index uses) yield only strings and numbers. Changing that would make every string keyword true start matching JSON booleans, so it is left as is and pinned by a test. The keywords reference now says so and points to a field match such as a: true.

Tests

• bool_keywords_search_for_the_word (IR compile path and Engine with its candidate index): keywords: [true] matches {"a": "true"}, flag is TRUE now, and a plain-text event, and does not match {"a": "false"}. {"a": true} does not match, which pins the JSON boolean behavior.
• test_bool_keyword_converts_as_text: the test backend converts the rule to _="true" instead of failing.

Both fail on the previous lowering. The SigmaHQ corpus regression (3,748 rules) is unchanged.

Fixes #587