Fix Kibana Discover URL when query_key value is empty or a single-item array

[thejohnrichard]

Description

Elasticsearch returns multi-valued fields as arrays even when they carry a single value. When a rule uses such a field as query_key, kibana_discover_app_state() currently emits a Kibana filter like params.query: [''] — a phrase filter that matches no documents. The reviewer follows the Kibana link from the alert and lands on an empty Discover view, which reads as a broken link.

Reproduction

• Rule: query_key: [db.name, user.name, cloud.instance.name, service.environment]
• Match doc (as MongoDB Atlas emits): db.name = [""], user.name = [""], cloud.instance.name = "platon", service.environment = "production"
• Rendered URL contains filters params.query: !('') for db.name and user.name, decoded from Rison as params.query: ['']. Kibana renders these as active filters, silently returns zero results.

Fix

Add a small normaliser and apply it to each query_key value before filter emission:

• None, '', [], [''], [None, ''] → collapse to None. Existing code path emits a negate-exists filter (matching the current behaviour for missing values).
• ['single'] → unwrap to 'single'. Existing code path emits the same phrase filter as the scalar case.
• Multi-value lists (e.g. ['a', 'b']) → passed through unchanged. Behaviour matches today's code so this PR does not attempt to change how those render.

Diff shape

• elastalert/kibana_discover.py: +32 / -0. No existing logic paths deleted.
• tests/kibana_discover_test.py: +126 / -0. Six new tests, no existing tests modified.
• CHANGELOG.md: 1-line note under 2.TBD.TBD → Other changes.

Checklist

• I have reviewed the contributing guidelines.
• I have included unit tests for my changes or additions.
• I have successfully run make test-docker with my changes. All tests pass; docs build clean.
• I have manually tested all relevant modes of the change in this PR.
• I have updated the documentation. Not applicable: this is a bugfix that restores the intended behaviour when a field is empty. No new configurable behaviour is introduced.
• I have updated the changelog.

Questions or Comments

New tests are parametric so they read as one block for the empty-value cases and mirror the existing null_query_key_value and str_query_key tests' expected URLs — deliberately keeping the assertions surface small and consistent with the file's existing style.

Multi-value list handling (rendering as a phrases/"IS ONE OF" filter) is deliberately out of scope for this PR: current behaviour is preserved, the change here is narrow, and a follow-up can add proper multi-value support later.