Fix aggregate_events leaking non-matching sub-events into buckets

[jichaowang02-lang]

Summary

SpiderFootCorrelator.aggregate_events corrupts its result buckets when a
correlation rule's field is a sub-field (e.g. child.data, source.data,
entity.data): each bucket retains sub-events that do not match the bucket
value, which then skews every downstream analysis that re-extracts sub-fields
(threshold counts, outlier counts, match_all_to_first_collection).

Root cause

event_strip() mutates the list it is iterating:

for s in event[topfield]:
    if s[subfield] != value:
        event[topfield].remove(s)

Removing the current element shifts the remaining elements down one index while
the iterator still advances, so the element immediately after each removed
one is never inspected and survives.

For field = "child.data" and one event with children a, b, c, d:

bucket	expected	actual (before fix)
a	["a"]	["a", "c"]
b	["b"]	["b", "d"]
c	["c"]	["b", "c"]
d	["d"]	["b", "d"]

(Reproduced against the real aggregate_events.)

Fix

Iterate over a snapshot copy so removal can't skip elements:

for s in event[topfield][:]:
    ...

Testing

$ pytest test/unit/spiderfoot/test_spiderfootcorrelator.py -q
17 passed, 55 subtests passed

Adds test_aggregate_events_does_not_leak_non_matching_subevents, asserting
each bucket keeps only its matching children. flake8-clean on the changed lines.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.