fix(plugins/rule-flood-guard): scope flood threshold per rule and data source

[yllada]

What

Changes how rule-flood-guard counts alerts before deciding to auto-disable a rule: the threshold now applies per (rule, data source) pair instead of per rule globally.

Why

The original counting logic grouped alerts only by rule name. This meant a rule firing legitimately once each across many different data sources/assets (e.g. the same detection catching a real, spreading incident on 50 different endpoints) could cross the threshold and get auto-disabled — exactly the wrong moment to lose that detection. Grouping by rule and data source correctly distinguishes "the same signal repeating without dedup on one source" (real fatigue) from "the same rule legitimately firing across many distinct sources" (not fatigue).

Changes

• aggregation.go: the OpenSearch query now nests a dataSource.keyword terms sub-aggregation inside the existing name.keyword terms aggregation (size 10000 for the inner level, mirroring the existing maxSourceBuckets convention in backend/modules/datasources/repository/stats_os.go). ruleBucket gained a DataSource field; parsing walks both levels into a flat list.
• guard.go: the threshold check and log context now operate per (rule, data source) pair. Disabling a rule and sending the notification are unchanged — a rule is still a single global toggle.
• backend.go: the notification message now names the specific data source that tripped the threshold, so the analyst knows where to look first.
• README.md: updated to describe the per-(rule, data source) counting semantics.

[github-actions]

✅ AI review — Clean

No issues detected in this diff.

✅ architecture (gemini-3-flash-lite) — clean

Summary: Routine dependency updates and logic refinement in rule-flood-guard plugin; no architectural deviations.

No findings.

✅ bugs (gemini-3-flash-lite) — clean

Summary: Updated flood guard logic to include data source in aggregation and notifications; no critical bugs found.

No findings.

✅ security (gemini-3-flash-lite) — clean

Summary: Routine dependency updates and logic refinement for rule-flood-guard plugin.

No findings.

🟢 go-deps — up to date

No pending Go dependency updates.