[New Rule] Google Threat Intelligence Domain IOC Correlation

### Description

This rule aims to correlate Domain found in event data with Google Threat Intelligence Threat List indicators to identify potentially malicious or suspicious activity. The rule avoids matching against Google Threat Intelligence’s own logs (`event.module: "ti_google_threat_intelligence"`) to ensure external observations are flagged.

### Rule Configuration

**Source Custom Query**

`NOT event.module : "ti_google_threat_intelligence"`

**Indicator Index Patterns**

`logs-ti_google_threat_intelligence_latest.dest_domain_ioc-*`

**Indicator Index Query**

`@timestamp >= "now-30d/d"`

**Indicator Mapping**

| Field | Indicator index field |
|-------------------|------------------------|
| `source.domain` | `threat.indicator.id` |
| `destination.domain` | `threat.indicator.id` |

**Required Fields**

`threat.indicator.id`

**Indicator Prefix Override**

`gti.threat.indicator`

**Related Integration**

`Google Threat Intelligence`

**Tags**

```
[
"Google Threat Intelligence",
"Domain IOC",
"Elastic",
"Threat Intelligence"
]
```

### Target Ruleset

threat_intel

### Target Rule Type

Indicator Match

### Tested ECS Version

8.16.0

### Query

_No response_

### New fields required in ECS/data sources for this rule?

_No response_

### Related issues or PRs

_No response_

### References

_No response_

### Redacted Example Data

_No response_