Support window in more time-series aggregations (elastic#138456)

This change adds support for window functions for additional time-series 
aggregations, including `min_over_time`, `max_over_time`,
`first_over_time`, `count_over_time`, and `sum_over_time`. These changes
are straightforward. The main update in this PR is how the window is
expanded before sliding over the partial results.

For example, given these data points:

```
|_tsid| cluster| host | timestamp            | metric |
| t1  | prod   | h1   | 2025-04-15T01:12:00Z | 100    |
| t2  | prod   | h2   | 2025-04-15T01:14:00Z | 200    |
```

With `bucket=5s` and no window:

```
TS ...
| WHERE TRANGE('2025-04-15T01:10:00Z', '2025-04-15T01:15:00Z')
| STATS sum(sum_over_time(metric)) BY host, TBUCKET(5s)
```

Yields:

```
cluster | bucket                 | SUM  |
prod    | 2025-04-15T01:10:00Z   | 300  |
```

With a window=5s:

```
TS ...
| WHERE TRANGE('2025-04-15T01:10:00Z', '2025-04-15T01:15:00Z')
| STATS sum(sum_over_time(metric, 5s)) BY host, TBUCKET(1s)
```

Yields:

```
cluster | bucket                 | SUM  |
prod    | 2025-04-15T01:12:00Z   | 100  |
prod    | 2025-04-15T01:14:00Z   | 200  |
```

Ideally, all buckets from `2025-04-15T01:10:00Z` to 
`2025-04-15T01:14:00Z` should be generated:

```
cluster | bucket                 | SUM  | 
prod    | 2025-04-15T01:10:00Z   | 300  |
prod    | 2025-04-15T01:11:00Z   | 300  |
prod    | 2025-04-15T01:12:00Z   | 300  |
prod    | 2025-04-15T01:13:00Z   | 200  |
prod    | 2025-04-15T01:14:00Z   | 200  |
```

With this change, buckets are expanded as if sliding over the raw input 
before combining for the final results.

Author: dnhatn