[TI_RecordedFuture] Support IoC expiration

[kcreddy]

In order to support IoC expiration for Recorded Future, following need to be added to the package:

Path forward:

• The current source indices should contain all IoC ingesting every interval. In other words, we need to maintain duplicate IoCs inside source indices. This needs removal of current fingerprint processor
• Create Latest Elastic Transforms, from source to destination indices.
  • Destination indices should only contain latest IoCs since the last time the transform ran and they are created using latest transform i.e, unique key with combination of fields event.dataset, threat.indicator.type, and Name
  • Transform also needs to define a retention policy for it to delete old IoCs.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[elasticmachine]

Package ti_recordedfuture - 1.9.0 containing this change is available at https://epr.elastic.co/search?package=ti_recordedfuture