fix: to avoid re-parsing SigmaString entries in values

[vl43den]

When using ConvertTypeTransformation(target_type="str") with EQL backend + ecs_windows pipeline, trailing backslashes before wildcards aren't escaped correctly.

Image|contains: '\Desktop\'

• Bug: "*\\Desktop\*" - trailing \ escapes the *
• Expected: "*\\Desktop\\*" - both backslashes escaped

Reason:
Tracing the pipeline leads to "ConvertTypeTransformation" -> apply_value() calls SigmaString(str(val)) which re-parses the string. The trailing backslash is then interpreted as escaping the wildcard added by the modifier.

This effect can be avoided by returning SigmaString values unchanged instead of re-parsing:

if isinstance(val, SigmaString):
    return val

Testing

• pySigma-backend-elasticsearch: 38 passed
• pySigma transformations: 139 passed

Related

Fixes #431, pySigma-backend-elasticsearch#167