Wrapped all-modifier result into NodeSubexpression

Fixes sigmac splunk backend: Wrong conversion for |contains|all #3443

tools/sigma/parser/modifiers/transform.py

@@ -72,7 +72,7 @@ class SigmaAllValuesModifier(SigmaTransformModifier):
         cond = ConditionAND()
         for val in self.value:
             cond.add(val)
-        return cond
+        return NodeSubexpression(cond)
 
 class SigmaBase64Modifier(ListOrStringModifierMixin, SigmaTransformModifier):
     """Encode strings with Base64"""