fix(filters): normalize actionResult to canonical values

[JocLRojas]

Detailed explanation of the changes

Normalize the actionResult field across seven pipeline filters so downstream rules, dashboards, and correlations receive a consistent, canonical vocabulary (denied / blocked / failed / success / accepted) instead of vendor-specific strings.

Reasoning behind these changes

Rules, dashboards and correlations across UTMStack depend on actionResult being one of a small, well-known set of values. Vendor logs use inconsistent casing and vocabulary (Denied, denied, Blocked, Failed, Failure, Succeeded, Success, etc.), which was leaking straight into actionResult through several rename steps. That leak broke downstream matching whenever a vendor changed casing or wording.

This change:

1. Prevents rename steps from overwriting actionResult with non-canonical values, using a negative regexMatch guard.
2. Explicitly maps the recognized signals to canonical values (denied, blocked, failed, success, accepted) via add steps.

The result is that correlation rules that filter by actionResult behave predictably regardless of the source vendor's spelling or casing.

Issue

No related issue.

[github-actions]

✅ AI review — Approved

No issues detected in this diff.

✅ architecture (gemini-3-flash-lite) — clean

Summary: No reviewable changes in this diff (excluded paths only).

No findings.

✅ bugs (gemini-3-flash-lite) — clean

Summary: No reviewable changes in this diff (excluded paths only).

No findings.

✅ security (gemini-3-flash-lite) — clean

Summary: No reviewable changes in this diff (excluded paths only).

No findings.

[utmstackprapprover]

Approved — no blocking issues, deps OK, authorized author. Any non-blocking warnings are listed above.