• Add support for threat
• Gracefully support query not being set
• Add esql specific validations to reject unsupported fields index and filters
• Add computed to action frequency to handle kibana provided defaults
• Add anomaly detection validation for required anomaly_threshold
• Add support for timeline_id and timeline_title fields
• Mark threat_query as computed to handle api provided default ""

Each change is self contained in a single commit, so it might be easier to review each separately.

Note: In general we want to move away from adding validations in models_* files I added some here due to time constraints. As part of the next milestone I plan to swap these out for validations at the schema level.