[FR] Update schemas to support runtime fields

[Mika Ayenson]

Summary

elastic/kibana#130929

Tasks

PR Checklist

Beta Give feedback

1. Link to the relevant Kibana PR or issue provided
2. Exported detection rule(s) from Kibana to showcase the feature(s)
3. Converted the exported ndjson file(s) to toml in the detection-rules repo
4. Re-exported the toml rule(s) to ndjson and re-imported into Kibana
5. Updated necessary unit tests to accommodate the feature
6. Applied min_compat restrictions to limit the feature to a specified minimum stack version
7. Executed all unit tests locally with a test toml rule to confirm passing
8. Included Kibana PR implementer as an optional reviewer for insights on the feature
9. Implemented requisite downgrade functionality
10. Cross-referenced the feature with product documentation for consistency
11. Incorporated a comprehensive test rule in unit tests for full schema coverage
12. Conducted system testing, including fleet, import, and create APIs

Dependencies and Constraints

...