EQL: Implement string function

[rw-access]

Part of #51556
https://eql.readthedocs.io/en/latest/query-guide/functions.html#string

Probably the most straightforward function in EQL.

Function behavior

Validation requirements:

• One exact argument (isExact check)

null behavior:

• this function will never return null
• obj.toString()

[elasticmachine]

Pinging @elastic/es-ql (:Query Languages/EQL)

[astefan]

I think I don't have the whole picture here and I am missing something obvious, thus my questions below, trying to learn more about this function.

What is the main use case for this function?
I see this example in your PR where a comparison is being made between string(serial_event_id) and "1". In this specific case, why not doing serial_event_id = 1?

Same question for the second example - string(ppid) == "null" - why not doing ppid == null?

[rw-access]

The string and number (#54471) functions were added to EQL to facilitate comparisons across types.

The test examples were clearly silly, but still tested the function with uncomplicated examples. Ideally, both functions will be rarely used, and every field transformation is done at index time. But having these functions helps us fill in the gaps when types don't quite match when you need them to.

The string function is also identical to concat, but with a single argument.