F/rewrite groupset

Added groupset rewrite object and added tests for rewrite functionality.
hmm... I don't see why we can't simply use the value-pairs() syntax instead of this separate fields() keyword.

groupset(value-pairs(pair("apache.*", "$(sha512 $_)"))

That way, we immediately can have a list of such additions, and as a performance optimization, also create a new message from scratch instead of modifying all the fields.