fix: Allow different order of the metadata fields in ESQL queries

[traut]

Pull Request

Issue link(s):

This request is a continuation of #4579

Summary - What I changed

• implemented logic adjustment from [enhancement] In esql validation, allow any order of metadata #4579
• added a unit test

How To Test

$ pytest tests/test_schemas.py ============================ test session starts ============================= platform darwin -- Python 3.12.11, pytest-8.3.5, pluggy-1.5.0 rootdir: /Users/traut/Work/detection-rules configfile: pyproject.toml plugins: anyio-4.9.0, typeguard-3.0.2 collected 11 items tests/test_schemas.py ........... [100%] ============================= 11 passed in 0.79s ============================= $

Checklist

• Added a label for the type of pr: bug, enhancement, schema, maintenance, Rule: New, Rule: Deprecation, Rule: Tuning, Hunt: New, or Hunt: Tuning so guidelines can be generated
• Added the meta:rapid-merge label if planning to merge within 24 hours
• Secret and sensitive material has been managed correctly
• Automated testing was updated or added to match the most common scenarios
• Documentation and comments were added for features that require explanation

Contributor checklist

• Have you signed the contributor license agreement?
• Have you followed the contributor guidelines?

[github-actions]

Bug - Guidelines

These guidelines serve as a reminder set of considerations when addressing a bug in the code.

Documentation and Context

• Provide detailed documentation (description, screenshots, reproducing the bug, etc.) of the bug if not already documented in an issue.
• Include additional context or details about the problem.
• Ensure the fix includes necessary updates to the release documentation and versioning.

Code Standards and Practices

• Code follows established design patterns within the repo and avoids duplication.
• Ensure that the code is modular and reusable where applicable.

Testing

• New unit tests have been added to cover the bug fix or edge cases.
• Existing unit tests have been updated to reflect the changes.
• Provide evidence of testing and detecting the bug fix (e.g., test logs, screenshots).
• Validate that any rules affected by the bug are correctly updated.
• Ensure that performance is not negatively impacted by the changes.
• Verify that any release artifacts are properly generated and tested.
• Conducted system testing, including fleet, import, and create APIs (e.g., run make test-cli, make test-remote-cli, make test-hunting-cli)

Additional Checks

• Verify that the bug fix works across all relevant environments (e.g., different OS versions).
• Confirm that the proper version label is applied to the PR patch, minor, major.

[Mikaayenson]

lgtm if the ci passes!

[eric-forte-elastic]

Love the unit tests 🚀 LGTM 👍