The notable absence here is the `event.*` fieldset, whose purpose will
momentarily be replaced by `indicator.reference` and
`indicator.provider`.

Since we no longer copy event.* during enrichment, these fields need to
live under threat.indicator if we want them in an enrichment (which we
do).

threat.indicator.dataset and threat.indicator.module are not specified
in this RFC. This data should already exist on the indicator document as
event.dataset and event.module. As they are not needed for the purposes of
enrichment, they do not need to be present under threat.indicator.

The current ECS tooling does not allow us to do the following:

    - name: threat.indicator
      reusable:
        expected:
          - at: threat.enrichments
            as: indicator

to convey the fact that threat.enrichments.indicator is the
threat.indicator fields nested under threat.enrichments.indicator.

Instead, we need to:

1. define the reused fields twice, under threat.indicator AND
   threat.enrichments.indicator (last commit)
2. Copy the new threat.indicator.* fields as new
   threat.enrichments.indicator.* fields (this commit)