[Security Solution][Detections] Handle dupes when processing threshold rules

[madirey]

Superseded by #83062

Summary

This PR makes changes to processing of threshold rules in order to prevent duplicates when evaluating thresholds over long lookback intervals. To do so, we make a best effort guess to reproduce the query from the last rule run, and ensure that any new matches still remain above the threshold, even when these previous matches are discarded.

TODO more to come...

Checklist

Delete any items that are not applicable to this PR.

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• Any UI touched in this PR is usable by keyboard only (learn more about keyboard accessibility)
• Any UI touched in this PR does not create any new axe failures (run axe in browser: FF, Chrome)
• This renders correctly on smaller devices using a responsive layout. (You can test this in your browser)
• This was checked for cross-browser compatibility

For maintainers

• This was checked for breaking API changes and was labeled appropriately

[kibanamachine]

💔 Build Failed

• continuous-integration/kibana-ci/pull-request
• Commit: af3b85f
• Pipeline Steps (look for red circles / failed steps)
• Interpreting CI Failures

Failed CI Steps

• Execute xpack-securitySolutionCypress
• Execute xpack-securitySolutionCypress

---

Test Failures

Creates and activates a new threshold rule.Detection rules, threshold Creates and activates a new threshold rule

Link to Jenkins

Stack Trace

Failed Tests Reporter:
  - Test has failed 1 times on tracked branches: https://github.com/elastic/kibana/issues/77540

AssertionError: Timed out retrying: expected '<button.euiButtonEmpty.euiButtonEmpty--text.euiFilterButton>' to have text 'Custom rules (1)', but the text was 'Custom rules (3)'
    at Context.eval (http://localhost:6111/__cypress/tests?p=cypress/integration/alerts_detection_rules_threshold.spec.ts:13513:59)

---

"after all" hook for "Creates and activates a new threshold rule".Detection rules, threshold "after all" hook for "Creates and activates a new threshold rule"

Link to Jenkins

Stack Trace

Failed Tests Reporter:
  - Test has not failed recently on tracked branches

CypressError: `cy.click()` failed because it requires a DOM element.

The subject received was:

  > `undefined`

The previous command that ran was:

  > `cy.get()`

Because this error occurred during a `after all` hook we are skipping the remaining tests in the current suite: `Detection rules, threshold`

Although you have test retries enabled, we do not retry tests when `before all` or `after all` hooks fail
    at ensureElement (http://elastic:changeme@localhost:6111/__cypress/runner/cypress_runner.js:161918:24)
    at validateType (http://elastic:changeme@localhost:6111/__cypress/runner/cypress_runner.js:161758:16)
    at Object.ensureSubjectByType (http://elastic:changeme@localhost:6111/__cypress/runner/cypress_runner.js:161794:9)
    at pushSubjectAndValidate (http://elastic:changeme@localhost:6111/__cypress/runner/cypress_runner.js:170212:15)
    at Context.<anonymous> (http://elastic:changeme@localhost:6111/__cypress/runner/cypress_runner.js:170549:18)
From Your Spec Code:
    at Object../cypress/tasks/alerts_detection_rules.ts.exports.deleteRule (http://localhost:6111/__cypress/tests?p=cypress/integration/alerts_detection_rules_threshold.spec.ts:14263:40)
    at Context.eval (http://localhost:6111/__cypress/tests?p=cypress/integration/alerts_detection_rules_threshold.spec.ts:13498:34)

---

Creates and activates a new threshold rule.Detection rules, threshold Creates and activates a new threshold rule

Link to Jenkins

Stack Trace

Failed Tests Reporter:
  - Test has failed 1 times on tracked branches: https://github.com/elastic/kibana/issues/77540

AssertionError: Timed out retrying: expected '<button.euiButtonEmpty.euiButtonEmpty--text.euiFilterButton>' to have text 'Custom rules (1)', but the text was 'Custom rules (3)'
    at Context.eval (http://localhost:6111/__cypress/tests?p=cypress/integration/alerts_detection_rules_threshold.spec.ts:13513:59)

---

and 1 more failures, only showing the first 3.

Metrics [docs]

✅ unchanged

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream