[Observability] Update alerts with relevant indices and permissions

[alaudazzi]

This PR updates the Observabilty rules by adding the following information:

• indices queried by default
• permissions are required to run the alerts

Closes #3699

Generative AI disclosure

Did you use a generative AI (GenAI) tool to assist in creating this contribution?

• Yes
• No

[github-actions]

Vale Linting Results

Summary: 2 warnings, 2 suggestions found

⚠️ Warnings (2)

File	Line	Rule	Message
solutions/observability/incident-management/create-an-apm-anomaly-rule.md	31	Elastic.DontUse	Don't use 'and/or'.
solutions/observability/incident-management/create-an-apm-anomaly-rule.md	31	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'using' instead of 'via'.

💡 Suggestions (2)

File	Line	Rule	Message
solutions/observability/incident-management/create-an-apm-anomaly-rule.md	31	Elastic.WordChoice	Consider using 'atypical, not typical' instead of 'abnormal', unless the term is in the UI.
solutions/observability/incident-management/create-an-inventory-rule.md	46	Elastic.Semicolons	Use semicolons judiciously.

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

[github-actions]

🔍 Preview links for changed docs

• solutions/observability/incident-management/create-an-apm-anomaly-rule.md
• solutions/observability/incident-management/create-an-inventory-rule.md
• solutions/observability/incident-management/create-log-threshold-rule.md

[alaudazzi]

@lucabelluccini @dominiqueclarke I started updating the rules pages based on the exchanges/drafts discussed offline. These are the first 3 pages:

• solutions/observability/incident-management/create-an-apm-anomaly-rule.md
• solutions/observability/incident-management/create-an-inventory-rule.md
• solutions/observability/incident-management/create-log-threshold-rule.md

Before I move too far with the remaining ones, can you please check if this is going in the right direction?

Thanks :)