[Maps][Alerting] Support runtime fields for containment alerts

[thomasneirynck]

Before Alerting goes GA, geo-containment alert should support runtime fields.

[elasticmachine]

Pinging @elastic/kibana-gis (Team:Geo)

[kindsun]

Testing Tracking containment alerting, I got the following results:

            UI		    Server query
keyword     Y           Y
date        Y           Y				
double      Y           Y
geo_point   Y         	Y				

To test Geo containment alerting, the following test mappings were used to generate alerts:

PUT /tracks/_mappings
{
  "runtime": {
    "rtTimestamp": {
      "type": "date",
      "script": {
        "source": "emit(ZonedDateTime.parse(params._source['@timestamp']).toInstant().toEpochMilli())"
      }
    }
  }
}

PUT /tracks/_mappings
{
    "runtime" : {
        "rtEntity_id" : {
            "type" : "keyword",
            "script" : {
                "source" : "emit(doc['entity_id'].value)"
            }
        }
    }
}

PUT /tracks/_mappings
{
    "runtime" : {
        "rtSpeed" : {
            "type" : "double",
            "script" : {
                "source" : "emit(doc['speed'].value)"
            }
        }
    }
}

PUT /tracks/_mappings
{
    "runtime" : {
        "rtLocation" : {
            "type" : "geo_point",
            "script" : {
                "source" : "emit(params._source.location.lat, params._source.location.lon)"
            }
        }
    }
}

[kindsun]

In spite of the fact that Runtime Fields appear to work fine, we probably still should move forward with leveraging the data plugin's SearchSource for queries to be more "future proof". Currently this isn't possible within an alert executor as the data plugin isn't one of the services passed in to the function. Adding the data plugin to the alerting executor function services has already been identified in #87990

[kindsun]

Since Runtime fields appear currently supported, closing this issue for now. We can re-open if anything changes.