feat: Keep-Alive correlation, TTL management, SIGHUP handling, logrotate support

Major features:
- One-to-many correlation mode (Keep-Alive) for HTTP connections
- Dynamic TTL for network events with reset on each correlation
- Separate configurable buffer sizes for HTTP and network events
- SIGHUP signal handling for log rotation without service restart
- FileSink.Reopen() method for log file rotation
- logrotate configuration included in RPM
- ExecReload added to systemd service

Configuration changes:
- New YAML structure with nested sections (time_window, orphan_policy, matching, buffers, ttl)
- Backward compatibility maintained for deprecated fields

Packaging:
- RPM version 1.1.0 with logrotate config
- Updated spec file and changelog
- All distributions: el8, el9, el10

Tests:
- New tests for Keep-Alive mode and TTL reset
- Updated mocks with Reopen() interface method

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>

config.example.yml

@@ -20,15 +20,44 @@ inputs:
 
 outputs:
   file:
+    enabled: true
     path: /var/log/logcorrelator/correlated.log
 
   clickhouse:
+    enabled: false
     dsn: clickhouse://user:pass@localhost:9000/db
     table: correlated_logs_http_network
+    batch_size: 500
+    flush_interval_ms: 200
+    max_buffer_size: 5000
+    drop_on_overflow: true
+    async_insert: true
+    timeout_ms: 1000
 
   stdout:
     enabled: false
 
 correlation:
-  time_window_s: 1
-  emit_orphans: true  # http toujours émis, network jamais seul
+  # Time window for correlation (A and B must be within this window)
+  time_window:
+    value: 1
+    unit: s
+  
+  # Orphan policy: what to do when no match is found
+  orphan_policy:
+    apache_always_emit: true  # Always emit A events, even without B match
+    network_emit: false       # Never emit B events alone
+  
+  # Matching mode: one_to_one or one_to_many (Keep-Alive)
+  matching:
+    mode: one_to_many
+  
+  # Buffer limits (max events in memory)
+  buffers:
+    max_http_items: 10000
+    max_network_items: 20000
+  
+  # TTL for network events (source B)
+  ttl:
+    network_ttl_s: 30
+