feat(microsoft_sentinel): Support custom entity grouping configuration per rule

[0xFustang]

Description

In this PR, we introduce two new custom fields for Microsoft Sentinel analytics rules:

1. Handle grouping_matching_entities

Allows specifying which entity types should be used for incident grouping. When this field is present, the matching method is automatically set to "Selected".

Example:

custom:
  grouping_matching_entities:
    - IP
    - Account
    - RegistryKey

2. Add grouping_period override

The existing grouping_period custom field now works across both incident creation scenarios (when incident_status is True or False).

custom:
  grouping_period: 24  # 24 hours