[Security Solution][Detection Engine] ES|QL rule type generates less alerts than expected with MV_EXPAND

[marshallmain]

The MV_EXPAND command is in preview and was added to ES|QL for 8.11 (https://www.elastic.co/guide/en/elasticsearch/reference/8.15/esql-commands.html#esql-mv_expand). This command takes a multi-valued column and produces a separate row in the results for each value. As a consequence, the results can have multiple rows with the same _id and _index values but the DE rule logic will only create an alert for one of these rows due to deduplication. We should investigate what the correct handling is in this scenario.

[elasticmachine]

Pinging @elastic/security-detection-engine (Team:Detection Engine)