[Rule Tuning] Elastic Defend Alert from Package Manager Install Ancestry

## Link to Rule
https://github.com/elastic/detection-rules/blob/main/rules/cross-platform/initial_access_elastic_defend_alert_package_manager_ancestor.toml

## Rule Tuning Type
False Negatives - Enhancing detection of true threats that were previously missed.

## Description

This rule ("Elastic Defend Alert from Package Manager Install Ancestry") currently recognizes a package-manager install context in its ancestry for npm (Node.js), PyPI (pip/Python/uv), and Rust (cargo). It's missing several other package-manager ecosystems that are equally viable install-time-hook supply-chain vectors and are covered by real, independently-confirmed detection gaps elsewhere in this ruleset's own history (e.g. this project's separately-proposed Composer install-script rule):

- **Composer / Packagist (PHP)**: `process.parent.name == "composer"` with `install`/`require`/`run-script` in the command line.
- **RubyGems / Bundler (Ruby)**: `process.parent.name in ("gem", "bundle")` with `gem install`/`bundle install`/`bundle exec` in the command line.
- **Go (pkg.go.dev)**: `process.parent.name in ("go", "go.exe")` with `go install`/`go get`/`go generate` in the command line.
- **Gradle (Java/Kotlin/Groovy build scripts)**: `process.parent.name in ("gradle", "gradle.exe", "gradlew")` with `build`/`assemble` in the command line.

Each is a real, distinct ecosystem with its own documented supply-chain incident history (malicious Composer plugins, malicious RubyGems, typosquatted Go modules, malicious Gradle build-script tasks). This rule's own "package manager ancestor" concept generalizes cleanly to all four using the same pattern already used for npm/pip/cargo.

**Real testing performed for the Composer branch specifically** (the others follow the identical, already-proven pattern from the existing npm/pip/cargo branches, so were not independently re-lab-tested): a real Composer plugin package (`composer-plugin` type, `PluginInterface::activate()`, the actual documented mechanism real Composer supply-chain attacks use) installed via a real `composer install`, producing a real `composer` parent spawning `sh -c "id"` as its child, a process chain that the extended `EVAL`/`CASE` branch correctly attributes to the Composer ecosystem.

## Example Data

Real captured chain (reshaped from real kernel-level process auditing into ECS process-event shape, since Elastic Defend's own eBPF sensor isn't available on the test host's kernel):
```json
{
"event": { "category": ["process"], "type": ["start"] },
"process": {
"name": "sh",
"args": ["sh", "-c", "--", "id"],
"parent": {
"name": "composer",
"command_line": "/usr/bin/env php /usr/bin/composer install --no-interaction"
}
}
}
```

Proposed additional `EVAL`/`CASE` branches (to add alongside the existing npm/pip/cargo branches):
```eql
// composer (PHP / Packagist ecosystem)
process.parent.name == "composer" AND (
process.parent.command_line LIKE "*composer*install*" OR
process.parent.command_line LIKE "*composer*require*" OR
process.parent.command_line LIKE "*composer*run-script*"), true,

// gem / bundler (Ruby / RubyGems ecosystem)
process.parent.name IN ("gem", "bundle") AND (
process.parent.command_line LIKE "*gem install*" OR
process.parent.command_line LIKE "*bundle install*" OR
process.parent.command_line LIKE "*bundle exec*"), true,

// go (Go / pkg.go.dev ecosystem)
process.parent.name IN ("go", "go.exe") AND (
process.parent.command_line LIKE "*go install*" OR
process.parent.command_line LIKE "*go get*" OR
process.parent.command_line LIKE "*go generate*"), true,

// gradle (Java/Kotlin/Groovy build-script ecosystem)
process.parent.name IN ("gradle", "gradle.exe", "gradlew") AND (
process.parent.command_line LIKE "*build*" OR
process.parent.command_line LIKE "*assemble*"), true,
```

Open rules/cross-platform/initial_access_elastic_defend_alert_package_manager_ancestor.toml and compare the existing npm, pip, and cargo EVAL/CASE branches. Use the supplied Composer process chain as a reference while checking the proposed Composer, RubyGems/Bundler, Go, and Gradle conditions. Done means the rule covers all four ecosystems without disrupting its existing package-manager ancestry detections.

Written by the indexing model from the issue text.