Epics: https://github.com/elastic/security-team/issues/1974 (internal), #174168

Summary

Implement algorithms for diffing and merging changes in RuleKqlQuery, RuleEqlQuery, and RuleEsqlQuery types of fields. It should be applied to:

Context from the Rule Customization RFC:

• Concrete field diff algorithms by type

To do

• Step 1 (separate PR)
  • Implement the algorithm and cover it with unit tests: [Security Solution] Adds diff algorithm and unit tests for query fields #190179
• Step 2 (separate PR)
  • Apply the algorithm to the corresponding rule fields. It will become used in the upgrade/_review endpoint.
  • Write a test plan covering rule upgrade scenarios for the fields to which the algorithm has been applied.
    • [Security Solution] Test plan for query fields diff algorithm #192529
  • Add test coverage according to the test plan (integration tests, primarily?).
    • [Security Solution] Integration tests for query diff algorithms #192655