Retrieving the matched rule fields

## What is your idea?
Is there currently any way to retrieve the matched rule fields? For example, given the following event and rule, can event-ruler return me the list: `['detail-type', 'resources', 'detail.state']`?
```
{
"version": "0",
"id": "ddddd4-aaaa-7777-4444-345dd43cc333",
"detail-type": "EC2 Instance State-change Notification",
"source": "aws.ec2",
"account": "012345679012",
"time": "2017-10-02T16:24:49Z",
"region": "us-east-1",
"resources": [
"arn:aws:ec2:us-east-1:123456789012:instance/i-000000aaaaaa00000"
],
"detail": {
"c-count": 5,
"d-count": 3,
"x-limit": 301.8,
"source-ip": "10.0.0.33",
"instance-id": "i-000000aaaaaa00000",
"state": "running"
}
}
```

```
{
"detail-type": [ "EC2 Instance State-change Notification" ],
"resources": [ "arn:aws:ec2:us-east-1:123456789012:instance/i-000000aaaaaa00000" ],
"detail": {
"state": [ "initializing", "running" ]
}
}
```

## Would you be willing to make the change?
Yes

## Additional context
Consider also how it'd work for an `or` group. Only one of the list sets would be returned

Add any other context (such as images, docs, posts) about the idea here.

Start by reviewing the event-ruler matching API and the existing handling of OR groups. Define how matched field paths should be represented for the supplied event and rule, including which result an OR match returns, then add tests that demonstrate the expected behavior.

Written by the indexing model from the issue text.