[Observability RAC] Implement workflow status filters UX for observability alerts table

[mgiota]

📝 Summary

Relates to #106585
Alerts Table Filter Options in Observability Alerts page should be updated according to following:

✔️ Acceptance criteria

• Move workflow status button group to left side above trend chart and change to sm, primary EuiButtonGroup ([RAC] Enable workflow status filtering #108215)
• Workflow button group statuses should be Open, Acknowledged, Closed ([RAC] Enable workflow status filtering #108215)
  • 
• Move Last updated... to same line as button group and right align
• Include Alerts total count (filtered by KQL bar + Workflow statuses) before DataGrid modifier buttons
• Remove 'Showing X alerts | Selected alerts 0'
• 'Take action' bulk action button renamed to 'X alerts selected'
• Remove 'Take action' bulk action button and 'Select all' button from default view. These should show only when a user selects a row (see above mockup for 'Filter option updated states')
  • None selected, Some selected, All selected
    

Note: Strikethrough options have already been implemented by the security team

Dependencies

• (hard dependency) [RAC] Populate workflow status fields for new lifecycle alerts #107650
• (soft dependency) The UI should give the option to the user to Add to case and Close

[elasticmachine]

Pinging @elastic/logs-metrics-ui (Team:logs-metrics-ui)

[afgomez]

• Move Last updated... to same line as button group and right align

This item is not as straightforward as it seems. Both the Last update label and value live within the TGrid component. It would need a way to expose this value to consumers.

@elastic/observability-security-team (or other) with whom I can speak about this to create a reasonable API?

[jasonrhodes]

Thanks for calling that out, @afgomez -- I think this would be @michaelolo24 / @XavierM and @elastic/security-threat-hunting

I'm fine if we punt on that change for right now and focus on getting the button group working.

[jasonrhodes]

Oh I see you've separated them in your PR, perfect. Thanks!