[Security Solution][Alerts] Log actual queries executed by detection engine

[marshallmain]

In some cases the detection engine dynamically loads data by reference that becomes part of the rule's query logic. Current examples include saved queries and exceptions. We don't keep detailed records of the generated queries in the alerts for each rule execution, instead the alerts only contain the IDs that reference the dynamically loaded data.

As a result, it's impossible to accurately reproduce a detection rule query from an alert document if the saved query/exception items have changed since the alert was generated. It would be good to build a record of the actual generated query, including the dynamically loaded portions.

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)