[Security Solution] [PRC Milestone 3] Update API and internal rule schemas with new fields

[jpdjere]

Prebuilt Rule Customization Epic - Milestone 3: #174168
Main Epic: https://github.com/elastic/security-team/issues/1974 (internal)

Additional Material:
- Milestone 3 - Software Design RFC
- Prebuilt Rules Customization Technical Design

---

Description:
Update our rule schemas as detailed in the Necessary rule schema changes of the software design document.

Concretely, the changes needed are:

1. In the API schema

• Creating the prebuilt field and its isCustomized and elasticUpdateDate subfields as common attributes in: x-pack/plugins/security_solution/common/api/detection_engine/model/rule_schema/common_attributes.schema.yaml
• Adding the prebuilt field as a non-required field in the Response Fields: x-pack/plugins/security_solution/common/api/detection_engine/model/rule_schema/rule_schemas.schema.yaml
• Updating the RuleImport schema in x-pack/plugins/security_solution/common/api/detection_engine/rule_management/import_rules/rule_to_import.ts with two changes:
  • keep immutable optional, but now accept the value true
  • add prebuilt as an optional importable field

2. In the internal rule schema

• Add prebuilt as an optional field to BaseRuleParams in x-pack/plugins/security_solution/server/lib/detection_engine/rule_schema/model/rule_schemas.ts
• Update the PrebuiltRuleAsset schema to include the optional elasticUpdateDate field in x-pack/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/model/rule_assets/prebuilt_rule_asset.ts. This field is currently being added by the TRaDE team to new version of rules.

---

• These changes should be backwards-compatible and should be able to be merged into main or a feature branch without making braking changes.
• One exception: changing the immutable schema for RuleImport will change the behaviour of our app, and allow users to import prebuilt rules, which is a breaking change. So on a first phase, we can limit this change to be: only update this schema to accept the prebuilt field and leave the immutable field untouched to keep the behaviour the same. Then create as follow up another ticket to complete the migration, once we are ready to accept the importing of prebuilt rules.

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

[jpdjere]

Closing in favour of new tickets planned: #174168 (comment)