event_log find by legacy IDs and legacy namespace

[kobelb]

Alerting rules currently have a legacyId field that is being used to retrieve event-log documents that were created prior to the great saved-object ID regeneration of 8.0. This allows the event_log's ClusterClientAdapter to create an ES query to return documents that match the following pseudo-SQL:

kibana.saved_objects.namespace == currentSpaceID AND (
  (kibana.saved_objects.id == newID AND kibana.version > 8.0) OR 
  (kibana.saved_objects.legacyID == legacyID AND kibana.version < 8.0)
)

This logic works at the moment because alerting rules can't be shared in multiple spaces. However, as soon as alerting rules can be shared in multiple spaces, we won't be able to rely on the namespaces field and we will need to store the legacyNamespace field on the alerting rule saved-object so we can perform the following pseudo-SQL:

(kibana.saved_objects.id == newID AND kibana.version > 8.0) OR 
(kibana.saved_objects.namespace == legacyNamespace AND kibana.saved_objects.legacyID == legacyID AND kibana.version < 8.0)

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)

[kobelb]

@mikecote @gmmorris do you all know whether there is a meta issue for sharing alerting rules in multiple spaces? This won't be necessary until we begin this work...

[mikecote]

@kobelb we have this issue opened => #80575