[ResponseOps] use Data Streams for AAD indices in serverless (#160572)

resolves #154266

Changes the way the alerts-as-data (AAD) indices are created and written
to, to allow them to be built as they have been in the past (alias and
backing indices created manually) OR as an ES Data Stream.

Serverless will use Data Streams, other environments will use the
existing alias and backing indices. The determination is made by
optionally including the `serverless` plugin, and determining if it's
available.

The implementation is organized around a `DataStreamAdapter` object,
which is instantiated with a "data stream" or "alias" flavor, and then
it handles the specialized behavior. Currently, a lot of the smaller
implementation bits, like setting property values in ES calls, is done
via in-line boolean checks of that object, as to whether data streams or
aliases are being used. This could probably be cleaned up some.

Existing non-serverless function tests are largely unchanged, as they
can't test the new data stream path. Some tests have been added to the
serverless function tests, to test basic reading / writing via updated
alert documents.

## DEFER

- more serverless AaD tests

- #158403 - this issue is more
noticeable now that we HAVE to do OCC with data streams, so we get
errors instead of simply overwriting documents (which is also bad)

Co-authored-by: Patryk Kopycinski <[email protected]>

x-pack/plugins/alerting/kibana.jsonc

@@ -30,7 +30,8 @@
       "usageCollection",
       "security",
       "monitoringCollection",
-      "spaces"
+      "spaces",
+      "serverless",
     ],
     "extraPublicDirs": [
       "common",