[ML] False positives associated with multi-bucket features

[tveasey]

We've had a number of support tickets raised related to false positives associated with multi-bucket features. Some of these are related to not having appropriate visuals. However, it also seems like the default parametrisation may be too sensitive.

There are a couple of avenues (which are not mutually exclusive) to explore:

1. User facing sensitivity controls.
2. A different parameterisation for multi-bucket detection.
3. More aggressively weighting the single vs multi-bucket contribution to the anomaly score.

[tveasey]

Item 2 was addresses in #491. Item 1 is an interesting issue in its own right and something which warrants its own issue, as it affects more than just multi-bucket analysis. Item 3 could be another form of user configuration. We already label results with the impact from multiple buckets, so I think this is lower priority. I'm going to raise a separate issue for sensitivity control and close this.