Add avg_over_time

[dnhatn]

This change adds the avg_over_time aggregation for time series indices. Similar to other time series aggregations, we need to translate avg_over_time into regular aggregations. There are two options for this translation:

1. Translate avg_over_time to EVAL div(sum_over_time, count_over_time), then translate sum_over_time and count_over_time to sum and count.
2. Translate avg_over_time directly to avg, and then to div(sum, count).

This PR chooses the latter approach. Below is an example:

TS k8s 
| STATS sum(avg_over_time(memory_usage)) BY host, bucket(@timestamp, 1minute)

translates to:

TS k8s
| STATS avg_memory_usage = avg(memory_usage), host_values=VALUES(host) BY _tsid, time_bucket=bucket(@timestamp, 1minute)
| STATS sum(avg_memory_usage) BY host_values, time_bucket

and then:

TS k8s
| STATS sum_memory_usage = sum(memory_usage), count_memory_usage = count(memory_usage), host_values=VALUES(host) BY _tsid, time_bucket=bucket(@timestamp, 1minute)
| EVAL avg_memory_usage = sum_memory_usage / count_memory_usage
| STATS sum(avg_memory_usage) BY host_values, time_bucket

Since we need to substitute AVG with SUM and COUNT after translation, we need to call SubstituteSurrogates twice in LogicalPlanOptimizer. If there is a performance impact, we can move this rule to TranslateTimeSeriesAggregate.

[elasticsearchmachine]

Pinging @elastic/es-analytical-engine (Team:Analytics)

[elasticsearchmachine]

Pinging @elastic/es-storage-engine (Team:StorageEngine)

[kkrik-es]

Nit: add ", that gets evaluated per time-series".

[dnhatn]

++ see 24ee2d3

[kkrik-es]

So simple, well done.

[martijnvg]

I also played around with it locally. LGTM

[dnhatn]

@kkrik-es @martijnvg Thanks for the reviews.