Update event.kind allowed value descriptions to clarify usage of "alert" and "signal"

[MikePaquette]

We have received questions from community members about when to use event.kind:alert vs. event.kind:signal

These allowed values can cause confusion, since documents that contain event.kind:signal are often referred to as "alerts."

As background, the overloading of the term "alerts" is a longstanding issue in security information and event management, where there was frequently confusion between external alerts generated by some external system and alerts generated by the SIEM itself. Any usage of the unmodified "alerts" was thus ambiguous.

The proposed language attempts to provide clear guidance:

• If the alert is created by a system external to the Elastic Stack, use event.kind:alert
• If the alert is created by the Elastic Stack/solution, use event.kind:signal

[ebeahan]

LGTM 👍

Thanks for updating these descriptions, @MikePaquette!

Since these are minor doc updates, let's include these changes into 1.11. I'll handle the backporting.