[FEATURE] PPL `eventstats` command enhancement

[dai-chen]

Is your feature request related to a problem?

The eventstats command was added in #3585, but there remain important gaps compared with Splunk SPL’s eventstats, affecting feature parity.

What solution would you like?

What alternatives have you considered?

N/A

Do you have any additional context?

Execution plan & priorities summary:

• P0
  • Close gaps in common aggregation functions (tracked separately)
    • Support distinct_count/dc in eventstats #4084
    • Add EARLIEST/LATEST aggregate functions for PPL #4100
  • Support aggregation wildcard * (tracked under the stats enhancement issue) [TBD]
• P0.5
  • Investigate the possibility of pushdown optimizations for SQL window function
  • Add a memory limit guard for large inputs.
• P1:
  • Deliver full parity for the allnum parameter
  • Add support for more aggregation functions