Support arrays as matching targets

The below rule works if the target field is not an array but fails when it is.

```
id: e781ae02-0d7b-4c3a-b1e3-d3b6b24f6c5b
title: Example Sigma Rule
description: Detects example log entries
status: experimental
author: Brian Kellogg
tags:
- test
logsource:
product: windows
service: sysmon
detection:
selection:
norm_keys.message|contains: 'error'
condition: selection
falsepositives:
- NA
level: high
```

Log:
```
{"count":5,"enabled":"true","lvl":"error","msg":["example","This is an error message"],"norm_keys":{"enabled":true,"level":"error","message":["example","This is an error message"]},"sigma_rules":[],"tags":["example","test"]}
```