fix: critical Keep-Alive correlation bug - network events evicted prematurely

- Fix cleanExpired() to use TTL map instead of event timestamp for B events
- Increase default correlation time window from 1s to 10s
- Increase default network TTL from 30s to 120s for long sessions
- Use payload timestamp for network events when available (fallback to now)
- Add comprehensive Keep-Alive tests (TTL reset, long session scenarios)
- Bump version to 1.1.7

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>

config.example.yml

@@ -40,25 +40,27 @@ outputs:
 
 correlation:
   # Time window for correlation (A and B must be within this window)
+  # Increased to 10s to support HTTP Keep-Alive scenarios
   time_window:
-    value: 1
+    value: 10
     unit: s
-  
+
   # Orphan policy: what to do when no match is found
   orphan_policy:
     apache_always_emit: true  # Always emit A events, even without B match
     network_emit: false       # Never emit B events alone
-  
+
   # Matching mode: one_to_one or one_to_many (Keep-Alive)
   matching:
     mode: one_to_many
-  
+
   # Buffer limits (max events in memory)
   buffers:
     max_http_items: 10000
     max_network_items: 20000
-  
-  # TTL for network events (source B)
-  ttl:
-    network_ttl_s: 30
+
+  # TTL for network events (source B)
+  # Increased to 120s to support long-lived HTTP Keep-Alive sessions
+  ttl:
+    network_ttl_s: 120