add json.dumps to fix multiline escape issue

[wingiti]

Pull Request

Issue link(s): Related #6071

Summary - What I changed

I changed the return value to be also json dumped for "multiline Triple Double Quoted" stuff.
Because it is also done for Triple Single Quoted things and usual single lines which don't have this issue.

Issue before fix:
Backslashes will not be escaped here and therefore will get lost when saved as toml file:

Single line string for example will be escaped:

The fix probably looks a little bit ugly as I had to remove the last line break before dumping and then adding it again.
I tried to do the dump already one step before at:

detection-rules/detection_rules/rule_formatter.py

Line 88 in 0b15511

lines = [line + "\n" for line in lines]

But this broke other things.

How To Test

1. Export the example rule from the related issue or use whatever rule with a filter containing backslashes and being longer than 120 characters.
2. Check the exported toml file for the number of backslashes.

Checklist

• Added a label for the type of pr: bug, enhancement, schema, maintenance, Rule: New, Rule: Deprecation, Rule: Tuning, Hunt: New, or Hunt: Tuning so guidelines can be generated
• Added the meta:rapid-merge label if planning to merge within 24 hours
• Secret and sensitive material has been managed correctly
• Automated testing was updated or added to match the most common scenarios
• Documentation and comments were added for features that require explanation

Contributor checklist

• Have you signed the contributor license agreement?
• Have you followed the contributor guidelines?

[wingiti]

This will fix the issue with the filter but will break the fields "note", "setup", "description", "osquery" if they are multiline as they are somehow additionally escaped below in lines 250-271.

Same issue applies to fix in PR #6000

Filter needs to be handled in another way or, from my perspective preferred, multiline should be escaped in general (like in this PR) but lines 250-271 needs to be removed. As I don't know what impact this might have I will wait for some further feedback for now.

[eric-forte-elastic]

For more details on this see: https://github.com/elastic/detection-rules/pull/6000/changes#r3191141974