[SIEM] [Detections] Cannot go back to "Default blank timeline" for a rule

[XavierM]

Summary

https://github.com/elastic/siem-team/issues/508

Preconditions:

SIEM prepackaged rules loaded
A duplicated rule with an assigned timeline different from "Default blank timeline"
Steps to reproduce:

  - Go to 'Detections'
  - Go to 'Manage signal detection rules'
  - Go to 'Edit rule settings' of the duplicated rule with the assigned timeline
  - Go to 'About'
  - Expand 'Advanced settings'
  - Select 'Default blank timeline' from 'Investigate detections using this timeline template'
  - Save the changes

Current behaviour:

The change is not saved and the rule is linked to the old timeline.

Expected behaviour:

The change is saved and the rule is linked to the 'Default blank timeline'

Checklist

Use strikethroughs to remove checklist items you don't feel are applicable to this PR.

• This was checked for cross-browser compatibility, including a check against IE11
• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• [ ]~~ Documentation was added for features that require explanation or tutorials~~
• Unit or functional tests were updated or added to match the most common scenarios
• This was checked for keyboard-only and screenreader accessibility

For maintainers

• This was checked for breaking API changes and was labeled appropriately
• This includes a feature addition or change that requires a release note and was labeled appropriately

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[kibanamachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: 7a2f989

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[spong]

Checked out, tested locally and verified this fixes the issue when reverting a duplicated Rule's Timeline Template back to the Default Template. Once saved, the rule now shows Default blank timeline as expected. I also tested the flow where you delete the timeline, and historical signals send to timeline action correctly uses the default blank timeline since it can't find the old timeline.

LGTM! 👍 Thanks @XavierM!