[8.14] [Request][8.14] improved ES|QL investigation (highlighted) fields (backport #5182)

[mergify]

Contributes to #5054

Preview:
Made several updates to the Create an ES|QL rule section:

• Updated the explanations for the fields that are returned by aggregating and non-aggregating queries.
• Added definitions and examples of new fields that can be created for either query type.
• Updated the limitations section so it no longer shows that new fields can't be added to a rule's custom highlighted fields.
• Created a new, short section about adding new fields to a rule's custom highlighted fields.

Twin Serverless PR: https://github.com/elastic/staging-serverless-security-docs/pull/349

---

This is an automatic backport of pull request #5182 done by Mergify.

[github-actions]

A documentation preview will be available soon.

• 🔨 Buildkite builds
• 📚 HTML diff
• 📙 Preview page

Request a new doc build by commenting

• Rebuild this PR: run docs-build
• Rebuild this PR and all Elastic docs: run docs-build rebuild

_{run docs-build is much faster than run docs-build rebuild. A rebuild should only be needed in rare situations.}

_{If your PR continues to fail for an unknown reason, the doc build pipeline may be broken. Elastic employees can check the pipeline status here.}