[streams][significant events] Add evidence to generated query

[klacabane]

Summary

Add query.evidence field that stores the reason a query was generated. No UI implemented in this change

Examples

{
  title: 'Connection Pool Exhaustion',
  kql: 'body.text:"Connection pool exhausted"',
  category: 'error',
  severity_score: 75,
  evidence: [
    'body.text: "Connection pool exhausted. Waiting for available connection."'
  ]
}

{
  title: 'User Account Lockout',
  kql: 'body.text:"User account locked"',
  category: 'security',
  severity_score: 85,
  evidence: [
    'body.text: "User account locked after 3 failed login attempts for userId: 58890"'
  ]
}
  
{
  title: 'NullPointerException Errors',
  kql: 'body.text:"NullPointerException"',
  category: 'error',
  severity_score: 85,
  evidence: [
    'body.text: "Consumer failed to process messageId: MSG-2583900002811578. Error: NullPointerException"'
  ]
}

[elasticmachine]

Pinging @elastic/actionable-obs-team (Team:actionable-obs)

[miltonhultgren]

LGTM, tested locally ✅

[flash1293]

LGTM, code review only, just changes significant events stuff

[elasticmachine]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: 8126719

Failed CI Steps

• FTR Configs #75

Test Failures

• [job] [logs] FTR Configs #75 / Alerting builtin alertTypes es_query rule runs correctly: threshold on ungrouped hit count < >

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
@kbn/streams-schema	219	221	+2

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
datasetQuality	505.9KB	505.9KB	+66.0B
streamsApp	1.1MB	1.1MB	+116.0B
total			+182.0B

Unknown metric groups

API count

id	before	after	diff
@kbn/streams-schema	226	228	+2

cc @klacabane