ES|QL Transaction Command: Group related events into logical sequences

## Value Proposition

Investigating multi-step processes — user sessions, order fulfillment, or security breach sequences — requires manually stitching individual events across time. Security teams currently rely on EQL for transaction-style correlation, limiting their ability to use ES|QL for detection rules that need sequence analysis.

## Expected Outcome

A new ES|QL command that groups consecutive events sharing common field values (e.g., session ID, user ID) within time constraints into a single logical transaction, enabling duration calculations and full sequence analysis directly in ES|QL.