… alerts as data alias (#184161)

Resolves #179829

## Summary

We've run into multiple SDHs where concrete indices exist for an
alerts-as-data resource but none of them are set as the write index for
an alias. This PR adds code to pick a concrete index and set it as the
write index to avoid these types of failures.

### Checklist

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios


### To verify

1. Go to [dev tools](http://localhost:5601/app/dev_tools#/console)
2. Create an ES Query rule
```
POST kbn:/api/alerting/rule
{
  "params": {
    "searchType": "esQuery",
    "timeWindowSize": 5,
    "timeWindowUnit": "m",
    "threshold": [
      -1
    ],
    "thresholdComparator": ">",
    "size": 100,
    "esQuery": "{\n    \"query\":{\n      \"match_all\" : {}\n    }\n  }",
    "aggType": "count",
    "groupBy": "all",
    "termSize": 5,
    "excludeHitsFromPreviousRun": false,
    "sourceFields": [],
    "index": [
      ".kibana"
    ],
    "timeField": "created_at"
  },
  "consumer": "stackAlerts",
  "schedule": {
    "interval": "1m"
  },
  "tags": [],
  "name": "test",
  "rule_type_id": ".es-query",
  "actions": []
}
```

3. Run the following commands to set `"is_write_index": false`
```
POST /_aliases
{
  "actions": [
    {
      "remove": {
        "index": ".internal.alerts-stack.alerts-default-000001",
        "alias": ".alerts-stack.alerts-default"
      }
    }, {
      "add": {
        "index": ".internal.alerts-stack.alerts-default-000001",
        "alias": ".alerts-stack.alerts-default",
        "is_write_index": false
      }
    }
  ]
}

GET .internal.alerts-stack.alerts-default-000001/_alias/*
```
4. Stop Kibana, but keep ES running
5. Start Kibana and verify that the rule runs successfully
6. Run the GET alias command to verify `"is_write_index": true`
```
GET .internal.alerts-stack.alerts-default-000001/_alias/*
```