[streamalert][bug] Fix to allow nested structured data and normalization

[javuto]

to @ryandeivert
cc @mime-frame

This code fixes the problem of having nested data in normalized fields and not be detected by the rules as datatype. Resolves: #333

Change

The method match_types now sets the value of record['normalized_types'] instead of returning it. Given that the method was being invoked recursively, the impacted field was not updated correctly and the nested normalized fields that we were interested on, they were not set. With this fix the existing rules work as expected while other new rules can be implemented and the normalization can be used with nested fields.

Testing

Tested for existing rules using python manage.py lambda test --processor all
Added coverage for this in the existing test tests/unit/stream_alert_rule_processor/test_rules_engine.py and checked with the following command:

$ ./tests/scripts/unit_tests.sh
...
Rules Engine - Match normalized types against record ... ok
Rules Engine - Recursively walk though all nested keys and update ... ok
...

[ghost]

Update your PR description with a Testing section with how you tested your changes @javuto :)

[coveralls]

Coverage remained the same at 94.693% when pulling 0f025c9 on normalized_nested_field_bug into 3cf6951 on master.

[coveralls]

Coverage remained the same at 94.693% when pulling cd77aea on normalized_nested_field_bug into 3cf6951 on master.

[ghost]

Awesome, thanks @javuto ! @ryandeivert - you're up :)

[ryandeivert]

@javuto please add the line resolves: #333 below the to & cc lines so the issue will be closed when this PR is merged

[coveralls]

Coverage remained the same at 94.71% when pulling cac8827 on normalized_nested_field_bug into bd72ce2 on master.

[javuto]

@chunyong-lin is taking care of this