[mostafa]

Stacked on #610; merge that first.

Closes #589.

rsigma-eval had two string timestamp parsers. The one behind the time-part modifiers lacked %Y-%m-%d %H:%M:%S%.f, which the correlation engine's parser had, so "2024-07-10 12:30:00.500" worked as a correlation timestamp but made ts|hour: 12 never match.

Changes

• New private timestamp module with parse_timestamp_str (RFC 3339, then the T and space naive forms with %.f, read as UTC) and normalize_epoch (values above 10^12 are milliseconds). chrono's %.f accepts a missing fraction, so the two plain %S formats are gone without losing any input.
• extract_timestamp_part (time-part modifiers) and parse_timestamp_value (correlation event timestamps) both use it. Correlation keeps its integer epoch path, so out-of-range epochs behave as before.
• The two duplicate correlation stringifiers are replaced by EventValue::as_str, which already had identical rendering. Group keys skip null as before; the value_count key still renders null as "null", now stated at that one call site.

Testing

• time_part_modifiers_accept_every_timestamp_form runs ts|hour: 12 over RFC 3339 with and without a fraction and with an offset, the T and space forms with and without a fraction, integer, millisecond, and float epochs, and garbage. On the old matcher, only the space-separated fractional form fails, which is the bug.
• test_parse_timestamp_every_form runs the same table through the correlation path, plus unit tests for the shared module.
• SigmaHQ corpus regression: identical to main, 3748 compiled and 0 errors.
• cargo fmt, clippy -D warnings, cargo doc, the full workspace test suite, and docs:build/docs:validate pass locally. CI does not run on this PR because its base is not main.