Feature/pipeline add condition should appear first in deferred expression

[suryamajhi]

Summary

This PR introduces an enhancement for deferred expressions (regex/logpoint_defer_contains) in Logpoint Search Query after the conversion.
In deferred expression, if a selected pipeline adds a ADD condition in the query like norm_id, label or other fields, all of them are deferred after search command. But they don't have to. Placing these enriched fields by pipelines in simple query (before a pipe) can drastically reduce the search space of later process commands to execute.

Current Query

| process eval(...)
.
.
.
| search label="Create" label="Process" integrity_level="System" user_contains="true" "process" IN ["*\calc.exe", "*\wscript.exe", "*\cscript.exe", "*\hh.exe", "*\mshta.exe", "*\forfiles.exe", "*\ping.exe"] OR command_contains="true"

New Query

label="Process" label="Create"
| process eval(...)
.
.
.
| search integrity_level="System" user_contains="true" "process" IN ["*\calc.exe", "*\wscript.exe", "*\cscript.exe", "*\hh.exe", "*\mshta.exe", "*\forfiles.exe", "*\ping.exe"] OR command_contains="true"

[d4rk-d4nph3]

This is the way!