Improve backend documentation

[mostafa]

I ran interrogate on the repository and it reported 23.7% coverage of docstring, which is low.

$ poetry add interrogate
$ poetry run interrogate -v
========================= Coverage for /pySigma-backend-loki/ ==========================
-------------------------------------------------- Summary ---------------------------------------------------
| Name                                           |        Total |        Miss |        Cover |        Cover% |
|------------------------------------------------|--------------|-------------|--------------|---------------|
| sigma/backends/loki/__init__.py                |            1 |           1 |            0 |            0% |
| sigma/backends/loki/loki.py                    |           33 |           7 |           26 |           79% |
| sigma/pipelines/loki/__init__.py               |            1 |           1 |            0 |            0% |
| sigma/pipelines/loki/loki.py                   |            2 |           2 |            0 |            0% |
| tests/sigma_backend_tester.py                  |            6 |           6 |            0 |            0% |
| tests/test_backend_loki.py                     |           44 |          42 |            2 |            5% |
| tests/test_backend_negation_loki.py            |           29 |          29 |            0 |            0% |
| tests/test_pipelines_loki.py                   |            2 |           2 |            0 |            0% |
|------------------------------------------------|--------------|-------------|--------------|---------------|
| TOTAL                                          |          118 |          90 |           28 |         23.7% |
------------------------------- RESULT: FAILED (minimum: 80.0%, actual: 23.7%) -------------------------------

It'd be nice if this is increased by adding more docstrings and module-level docs.

https://github.com/grafana/pySigma-backend-loki/issues/6#tasklist-block-b6c269fd-7a6f-4f8c-8b67-bdd711b969a6

This should also include moving existing comments into docstring format (see #8).