Proposal for fieldref wildcard support

[kelnage]

Field references can currently only specify a full match on two fields, but for backends that support it, we have found that in practice being able to partially match one field against another is important. This commit introduces the ability for a field reference to have a leading or trailing wildcard and updates the contains, startswith, and endswith modifiers to allow the rule to set them.

Note: the current design assumes that the modifiers will be applied with the fieldref first, then the relevant wildcard modifier. Changing this order would require being able to extract the leading/trailing wildcards from the SigmaString - which is doable, but would require some additional logic to achieve.

[nasbench]

@frack113 when this gets merged we need a validator for HQ to make sure the order is respected. If you can put it in your to-do.

[thomaspatzke]

While integration into the default backend code I've made some change to the type and modifiers. Now just starts_with and ends_with flags are set to True instead of storing a SpecialChar object into the wildcard_start and wildcard_end object variables which is always the same SpecialChars.WILDCARD_MULTI. This simplifies this change a bit and makes the code more efficient.