Validate indicator is present for the ECS threat.indicator.type

When [threat.indicator.type](https://www.elastic.co/guide/en/ecs/current/ecs-threat.html#field-threat-indicator-type) is populated, there is an expectation in Kibana that the event will contain a particular field with the indicator value. For example, if the type is `url`, then the event should have a `url.full` field.

So perhaps when `event.type == indicator && threat.indicator.type != null`, we then verify that one of the fields associated with the `threat.indicator.type` value is populated. The expected fields are listed in:

https://github.com/elastic/kibana/blob/33c18c72fa019430c6b73503dc3176e0136e3861/x-pack/solutions/security/plugins/threat_intelligence/server/utils/indicator_name.ts#L18-L53

This would help us be more consistent with our Threat Intelligence (TI) data. We might also want to codify this as part of ECS too.

Related:

- https://github.com/elastic/integrations/issues/12852
- https://github.com/elastic/integrations/pull/12915

Start by reviewing the expected field mapping in Kibana's x-pack/solutions/security/plugins/threat_intelligence/server/utils/indicator_name.ts and the related integrations issue and pull request. Then locate the relevant elastic-package validation entry point. Done means indicator events with a populated threat.indicator.type are checked for the corresponding indicator field, with validation coverage for the supported types.

Written by the indexing model from the issue text.