fix: use numeric severity values in GuardDuty Sigma detections

[abraithwaite]

Summary

• GuardDuty findings use numeric severity values (1-10), not text labels like 'CRITICAL' or 'High'
• All four GuardDuty Sigma rules were matching on text strings that never matched any real events
• Updated severity matching to use the correct numeric ranges per the AWS GuardDuty severity scale:
  • Critical: 9, 10
  • High: 7, 8
  • Medium: 4, 5, 6
  • Low: 1, 2, 3
• Added explicit sourcetypes: [guardduty] to all four rules

Test plan

Validated with runreveal lint sigma and runreveal detections run against real GuardDuty ndjson events:

# Lint all four rules
runreveal lint sigma detections/aws/guardduty/sigma/

# Test against sample guardduty events (one raw finding JSON per line)
runreveal detections run -f detections/aws/guardduty/sigma/high-severity-findings.yaml -i guardduty-events.ndjson
runreveal detections run -f detections/aws/guardduty/sigma/medium-severity-findings.yaml -i guardduty-events.ndjson
runreveal detections run -f detections/aws/guardduty/sigma/low-severity-findings.yaml -i guardduty-events.ndjson
runreveal detections run -f detections/aws/guardduty/sigma/critical-findings.yaml -i guardduty-events.ndjson --fail-no-match=false

Results confirmed each severity value matched only its correct bucket with no false positives across rules.

Closes RUN-2920