[mostafa]

Stacked on #615; merge that first.

Fixes #588.

Inhibit source cap

InhibitStore was the only alert-pipeline store without a count cap. Sources were pruned by duration only, so equal selectors over attacker-influenced values (source IPs, usernames) could grow it without bound within the window.

• A new top-level max_inhibit_sources key (default 100000) caps tracked sources across all inhibit_rules. It sits next to max_silences rather than inside a rule, because the store is shared.
• At the cap, a result that would open a new source is still checked as a target but is not tracked, and the refusal is counted on rsigma_inhibit_sources_refused_total{rule}. Already-tracked sources keep refreshing. This matches how the sibling stores refuse new entries instead of evicting.
• Restore and hot-reload trim the store to the cap through the existing CapTrim path, keeping the most recently seen sources, and the eviction warning includes inhibit_sources.
• Library additions: AlertPipelineFile::max_inhibit_sources, CapTrim::inhibit_sources, and MetricsHook::on_inhibit_source_refused (a default no-op).

Long correlation windows

max_group_entries stays unbounded by default, because a finite default would silently stop event_count rules whose threshold exceeds it. Instead, CorrelationEngine::add_correlation logs a warning when a correlation's timespan is longer than one hour and neither rsigma.max_group_entries nor the engine config caps its groups. For example:

Correlation 'corr-long' has a 86400s timespan and no per-group entry cap; a busy group retains timespan x event rate entries. Set max_group_entries (--max-group-entries) or the rsigma.max_group_entries attribute to bound it.

Tests

• new_sources_past_the_cap_are_refused: a refused source neither inhibits nor counts toward the cap, and a tracked source still refreshes at the cap.
• enforce_cap_keeps_the_most_recently_seen.
• The existing restore and reload cap-trim tests now include an inhibit rule and assert that only the newest three sources survive.
• test_long_window_without_group_cap_is_flagged: covers a 2h window, a 1h window, an engine-level cap, and the per-rule attribute.
• SigmaHQ corpus validation is identical to main (3748 compiled, 0 errors).