[ti_anomali] Fix tags variable in threatstream policy test

[mrodm]

Proposed commit message

Fix policy test in ti_anomali test package for threatstream data stream (relates #17428).
Currently, the value set in the policy is null, but this should not be possible since tags is a required variable.

• Current policy test configuration:
  

  integrations/packages/ti_anomali/data_stream/threatstream/_dev/test/policy/test-all.yml

  Lines 12 to 14 in 579e9a3

  	ioc_expiration_duration: "90d"
  	tags:
  	preserve_original_event: false

• Current expected policy:
  

  integrations/packages/ti_anomali/data_stream/threatstream/_dev/test/policy/test-all.expected

  Line 40 in 579e9a3

  tags: null

In the next elastic-package release, this process to create the policy with the variables from the test will be updated and this test will fail.

This Pull Request updates the value set in tags (defining one tag) and the corresponding expected file:

    tags:
      - custom-ti_anomali

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• [ ] I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• [ ] I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• Run tests with the upcoming changes in elastic-package https://buildkite.com/elastic/integrations/builds/38941

How to test this PR locally

elastic-package stack up -v -d --version 8.18.0
cd packages/ti_anomali
elastic-package test policy -v
elastic-package stack down -v

Related issues

• Follows [ti_anomali] Add Benchmark and Policy Test #17428
• Relates Policy tests: order-independent OTel ID normalization elastic-package#3318
• Relates [Policy tests] Use go-ucfg to read policy test configuration files elastic-package#3299

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 17c0537

cc @mrodm

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)