changed cardinality agg logic in action_status

[juliaElastic]

Summary

Related to #144161

Changed logic in action_status API calculation of agent action acks, to only use cardinality agg if the doc count is less than the precision threshold (40k, this is the max value).

Observed an issue locally that after successful add/remove tags, the ack count didn't reach 50k in action_status response, in this case doc_count was correct, 50k.
So it looks like the cardinality agg can be lower or higher than the actual count.

 {
        "key": "d3b1ef6c-2ed4-4746-ab88-504bf0c4b4c8",
        "doc_count": 50000,
        "max_timestamp": {
          "value": 1666956506014,
          "value_as_string": "2022-10-28T11:28:26.014Z"
        },
        "agent_count": {
          "value": 49874
        }
      }

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[criamico]

LGTM

[kibana-ci]

💚 Build Succeeded

• Buildkite Build
• Commit: 4378b03

Metrics [docs]

✅ unchanged

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @juliaElastic

[kibanamachine]

💚 All backports created successfully

Status	Branch	Result
✅	8.5

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

[mistic]

Added v8.5.1 tag has the backport for 8.5 didn't make the v8.5.0 release.