[RAC] Enhance index bootstrapping logic with support for additional aliases and proper ILM rollover per namespace

[banderror]

Parent ticket: #101016
Needed for: migrating Security Solution's .siem-signals-* indices to the new alerts-as-data indices

Summary

1. There is currently no ILM policy associated with the concrete indices created by the RuleDataClient. We can start by associating all concrete indices with the default ILM policy created by the rule registry. However, we also need to add an additional index template per index alias in order to specify the rollover_alias for the concrete index. (https://www.elastic.co/guide/en/elasticsearch/reference/current/getting-started-index-lifecycle-management.html#ilm-gs-alias-apply-policy) Without an ILM policy, the index will eventually become much larger than necessary and could hinder performance.
2. In the security solution, we'd like to add an additional alias to the alerts-as-data indices in order to make them backwards compatible with existing user defined queries and visualizations built on the .siem-signals naming scheme. To accomplish this, we'd add an additional parameter to RuleDataClient that allows callers to specify an optional "secondary alias" that would be added to the concrete indices.

A note regarding ILM policy, index template and namespace:

• Each alerts-as-data index managed via rule_registry must include a (in general, user-defined) namespace: .alerts-{registrationContext}.{datasetSuffix}-{namespace}
• At least in Security, this namespace is not known at star-up time (setup phase of the plugin). It becomes known in the scope of a rule instance, e.g. inside the rule type executor.
• We'd like to have an ILM policy applied to our indices. We'd like to be able to decide, should we use the default shared policy, or specify a custom one for a particular index.
• Correctly applying a policy with rollover logic requires creating an index template that would be pointing to the corresponding index alias with namespace in it:
  • index.lifecycle.name should be equal to the policy name
  • index.lifecycle.rollover_alias has to be the alias to rollover when the concrete index reaches the condition defined in the policy
• Since the alias includes the namespace, we need to specify a different index.lifecycle.rollover_alias for every namespace - Elasticsearch doesn't automatically find the correct alias for us.
• Which means we will have to delay creating/updating the index template until later - until the namespace becomes known.

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[banderror]

Addressed in #108115