[Security Solution][Detections] Investigate removing usage of internal tags

[spong]

With #92036, the Alerting team enabled the ability to filter on string parameters within our custom alert params. As a result, we should be able to use this to remove our internal_tags workaround for filtering on the immutable custom field. While immutable is a boolean, this fix leverages the flattened mapping under the hood, and so we should be able to use the string representation "true" or "false" to filter rules accordingly. e.g. alert.attributes.params.immutable:"true"

Testing real quick, I modified:

kibana/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.ts

Lines 113 to 118 in 4584a8b

	const showCustomRuleFilter = filterOptions.showCustomRules
	? [`alert.attributes.tags: "__internal_immutable:false"`]
	: [];
	const showElasticRuleFilter = filterOptions.showElasticRules
	? [`alert.attributes.tags: "__internal_immutable:true"`]
	: [];

to be:

  const showCustomRuleFilter = filterOptions.showCustomRules
    ? [`alert.attributes.params.immutable: "false"`]
    : [];
  const showElasticRuleFilter = filterOptions.showElasticRules
    ? [`alert.attributes.params.immutable: "true"`]
    : [];

And this appears to work! 🎉

For more details on the internal_tags implementation, please see the original PR here: #52838

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)