EQL: Add ? param support

[rw-access]

Relates to #51756 (closed with API support)

Add support for ? params to EQL. This hasn't been integrated/tested with for the API, but that can be added here easily if this is the right PR for that.

[elasticmachine]

Pinging @elastic/es-search (:Search/EQL)

[astefan]

I've left few comments.

Also, since ? has other meaning in the grammar, as well, I would like to see a test that contains both uses of ?. For example:

assertEquals(expr("a == ?\"String with literal 'slash' \\ characters included\" and b == ? or c == ?", Arrays.asList("test", false)),
                expr("a == ?\"String with literal 'slash' \\ characters included\" and b == 'test' or c == false"));

[costin]

Left some comments - more tests are needed to check that not only the param get replaced but also that tricky strings are properly added in the query.

[costin]

Why protected and not private?

[matriv]

@elastic/es-ql

[matriv]

After searching around regarding query params in SQL DBs, I saw that ? is the one used for prepared statements, and then each DB uses different syntax for its procedural language (defining custom functions/stored procedures, etc) like: @param, $param or :param. In my opinion I would say let's proceed with the basic usage of ? as a place holder and a list (array) of value replacements that correspond to those params.