[FR] Support for AWS Security Lake

### Repository Feature

None

### Problem Description

Elastic has several clients adopting AWS Security Lake to centralize AWS logs (e.g., CloudTrail, VPC Flow, WAF). Our AWS Security Lake integration ingests this data reliably. However, many customers also want to use Elastic’s out-of-the-box (OOTB) AWS detection rules that were authored for package-specific sources (e.g., aws.cloudtrail.*, aws.vpcflow.*, aws.waf.*).
Security Lake normalizes events to OCSF and our Security Lake integration reflects that schema, so field paths/datasets differ from those expected by today’s OOTB rules. As a result, rules do not match without manual field translation and re-authoring, which creates friction and limits the value of the integration.

### Desired Solution

Ship and support OOTB detections that work directly on Security Lake (OCSF) data. initially CloudTrail with parity to existing AWS rules where feasible.

### Considered Alternatives

Manual translations

### Additional Context

Security Lake adoption is accelerating across mid-to-large AWS estates and MSPs. First-class rule support would materially increase the out-of-box value of Elastic’s Security Lake integration.