TL;DR: Don't just look at system, but your approach to a protracted battle. Find a system with realistic damage ratios, and simulate most of the battle through skill checks with possibly dire results for failure.
The big problem
I understand that you are asking for a game recommendation, and I will list a few, but the problem isn't just the system you might use but also how you approach a battle as a whole.
Most systems use a short duration combat turn that is between 1 to 60 seconds, typically sitting at 6 or 10 seconds per 'round/turn'. Almost any system, due to this, will need to greatly abstract the 'standard combat system' for the general gunfire and cover/shoot/move aspects by warping time as you go.
Ambushes
Ambushes are VERY deadly in reality. You have someone that is likely completely blind of what's going on being assaulted by an individual, a group, or simply the equipment of people that are expecting absolute control of the situation.
Tactics in modern warfare for an ambush commonly either employ people in well chosen locations firing at a central location or remote explosion detonation. Using both is frequent. If the actual catalyzing event of the ambush is a detonation and it is not set to automatically fire, then the person with the control of the detonation has the ability to choose exactly which vehicle to kill people in.
In reality this generates enough fear and paranoia that even a teddy bear sitting in the road is suspect, as is discoloration of the road or recent repairs.
If you are not the targeted vehicle/person in the ambush, then it can and will likely turn into a protracted battle that can last a long time. This means a lot of bullets flying, but very little movement, movement that is highly controlled, and a lot of cover fire to cause the enemy to pause long enough that you can hope that you won't get shot directly at while moving. This is more of an extended skill check series that has dire consequences for failing than actual combat rounds.
Possible Systems
Almost any system can make this a worthwhile roleplay, just as almost any system can make this a very poor roleplay that takes forever to resolve a single encounter (due to the length of the combat turn). Here are a few systems I might try this type of combat in:
As mentioned by gomad, GURPS does a good job simulating a much more realistic world by keeping the base game very realistic stat-wise and having very realistic applications of armor and cover (making it near impossible to get hit if you protect yourself properly). This is actually my preferred choice, since it requires the least doctoring to get running right.
One of the d20 titles (*d20 Modern** or Star Wars, I think, maybe both) had two abstractions for damage taken. You had your actual health (based directly on constitution), and the traditional hit points, which were listed as an abstraction of near misses, dodging out of the way just in time, exhaustion, and slightly injuring yourself in an effort to get away from the fight. I don't think this is the right fight, but it could work for some types of games similar to this. This is my least favorite system listed here. This is the most likely system to get a character hit by a shot on the way to the shooter though not necessarily the most lethal.
World of Darkness (not the supernatural splat books) simulates a low hit point system, and since by default guns are unsoakable damage it is lethal for normal humans. You don't have to use any of the supernatural stuff associated with WoD in order to create a realistic battle, but should you want to add an element of the supernatural, it's easy to throw in.
Shadowrun is another possible choice. Ambushes do turn ugly very quickly in this game. It's based on a futuristic version of earth, so if you want cyberpunk, then it works well. You can play with or without magic as you feel comfortable with. Characters are a little less squishy than in WoD or GURPS, but that doesn't stop bullets from killing people quickly. You can also declare the guns listed to be equivalent to modern day weapons instead, and get rid of both aspects.
Most systems that try to implement realistic hit points can work, especially if rules for cover are well established.
Doctoring the System/Encounter
No matter what you do, it's unlikely that you want to have a 6 hour fight broken in to even 1 minute combat rounds, since that is going to take you more than 6 hours of real life to complete a single encounter scenario. I suggest modifying how you approach combat completely and breaking away from the 'combat round' to simulate the entire encounter.
D&D 4e had a very interesting idea that had a very poor implementation, but can be used for inspiration. Skill Encounters. An encounter that is completely based around skills. Although they had refined this process by the end of 4th edition's run, it wasn't very popular because it felt rather limiting, but even deadly encounters could be turned in to skill encounters. Although it's fantasy, one of the examples of this was running from a horde of zombies. Failures, especially very low failures, could cause damage or even death, but every single round wasn't covered in the 'combat round' sense. Some skill encounters even resulted in combat on failure of a roll or the encounter itself. The objective was to allow the players to roll for skill checks as they describe approaching the scenario. They have to hit a specific number of successes on these checks before a specific number of failures (and often they needed as many as 50% more to double the number of successes as failures).
How would someone implement a skill encounter for this type of scenario?
Make a difference between a 'combat round' and an 'assault round' to allow for that abstraction and it becomes relatively easy. The initial encounter of the ambush would be a few traditional rounds of combat until the players can get out of the obvious danger. After this, switch to 'assault' rounds (or some other appropriate adjective), making each round a matter of the players positioning themselves.
Note, this is simply one approach that I believe best simulates the experience without turning combat into a slog of misses for 12 hours straight.
Sample Skill Encounter
Since I extracted the idea from D&D, I will use it's basic stat system in my example: (Strength, Dexterity, Constitution, Intelligence, Wisdom, Charisma, plus Reflex, Fortitude, and Will 'saves')
Design the encounter with a host of 'normal skill checks' to use in the encounter. These checks are going to be based on the most common courses of actions:
Move: This should be a check based on either wisdom (perception) or dexterity (stealth). It simulates either timing your movement for a 'safer' period of time, or moving low to the ground and avoiding direct sight for extended periods. If your system incorporates speed as a roll-able stat this would be appropriate as well. This should generate a 'success' for each successful role, while failure means the character is likely shot at during the move (with normal penalties to hit based on circumstance). Success allows them to get a specific distance. This should be abstracted from their movement rate, extrapolated for multiple rounds. 100 meters, 500 meters, or some other appropriate distance for how long you want the encounter to last. (Don't simply use it as a single movement action, or you won't have sped up the combat.)
Cover Fire: This should be some form of mental check to determine timing (int/wis) or ability to force your opponent to stop firing (at least toward your ally) (cha). This would not generate successes for itself, but instead would give allies the chance to move more easily (a significant bonus to ally's checks for the round). ammunition is expended, but cover is provided on a success.
Locate Attacker: Although this seems like an obvious one, don't take it for granted. The attacker will have an advantage if the ambushed characters don't know the direction to move, or don't know the location they are firing from. I would likely require two successes for this skill check. The first to locate the general direction the enemy is in, and the second to isolate the enemy to a specific area. Obviously the first check would be required before the characters can appropriately hide or even move in the general direction of the enemy. It should be average difficulty unless the attack came from a different direction than the enemy (remote detonating devices, for example) or there are multiple directions of fire, and should certainly be easier than locating a specific position. This is a wisdom (perception) check, and obviously, the further the enemy is from their position, the harder it will be to locate them.
Take Cover: Either total cover or concealment is likely preferred, as anything less than that is likely to get shots taken at the character. If concealment, give a dex (stealth) check, if cover, just count it as a success making them impossible to hit. (Concealment only protects you from being seen, cover has physical substance that can stop a bullet.) This should be required of all characters any round they take an action other than staying in the cover/concealment they are already in. It shouldn't count toward successes, but should certainly count toward failures (and the possibility of getting shot) if a role is made. Do not allow players to take a shot at the ambushers until that character knows exactly where the enemy is.
So the primary courses of action are covered, 'Move', 'Cover Fire', 'Locate', and 'Take Cover'. The players will likely come up with other scenarios. Make judgement calls on what effects those rolls will have. Throwing a smoke grenade could provide total cover to a certain distance of movement, thus giving a high advantage of some sort to movement.
Next we need to look at consequences for failure. In this situation the consequences for failure on most rolls will be to be shot at. Apply distance and cover modifiers to make an appropriate value, and let the enemy take a shot at the character. Any other costs of failure can be brought up on the fly. Overall failure of the challenge would be determined by losing people (possibly all of them). To make it more militaristic, you can have a threshold of failures (or casualties) before the order to withdraw is made.
Consequences of success: If the group succeeds at the skill challenge, they can move into position to attack the ambusher. This would move the game back to a few quick combat rounds to resolve the end of the encounter. Every counted success can move the entire party forward the appropriate distance, or can be split so players have to take turns making cover fire/movement actions depending on the desired amount of realism.
Wrapping it up
This type of an encounter system allows the tedious aspects to still provide appropriate levels of danger, while not requiring a roll every 1-10 seconds of game play for every player. Technically it isn't really combat until they are directly engaged with each other, and this is a nice abstraction that allows the battle to move swiftly in RL terms compared to playing the whole thing out as a standard combat.
If you have a system that deals with damage from guns relatively realistically, then you can model this type of encounter system to create a gripping encounter that will definitely be exciting enough to create the atmosphere of a realistic battle, while not being remembered for mind-numbing, time-consuming rolls for hours on end.
