Remove ineffective distinct from postfix-very-slow-bf_user-enum

[Copilot]

Description

The review flagged that evt.Meta.sasl_username is not populated by crowdsecurity/postfix-logs, so the distinct condition made the user-enum variant effectively non-functional. This PR applies the requested minimal fix by removing only that distinct directive.

• Scope
  • Update scenarios/melite/postfix-very-slow-bf.yaml only.
• Change
  • In melite/postfix-very-slow-bf_user-enum, remove:

    distinct: evt.Meta.sasl_username

• Resulting rule fragment

  type: leaky
  name: melite/postfix-very-slow-bf_user-enum
  filter: "evt.Meta.log_type == 'postfix' && evt.Meta.log_type_enh == 'spam-attempt'"
  groupby: evt.Meta.source_ip
  leakspeed: "4h"
  capacity: 5

Checklist

• I have read the contributing guide
• I have tested my changes locally
• For new parsers or scenarios, tests have been added
• I have run the hub linter and no issues were reported (see contributing guide)
• Automated tests are passing
• AI was used to generate any/all content of this PR