Implement setting index mode to lookup

I am trying to implement an integration based on a DFIR Tool ([ADtimeline](https://github.com/ANSSI-FR/ADTimeline]ADTimeline)), part of the project has a Splunk app, which for some dashboards uses joins.

To be able to overcome the current limitations with JOIN operation in ES I had 2 choices :
- Go with an enrichment policy, however I could not find a trace anywhere of this being a supported asset (would still have its use-case imo as a sidenote)
- Go with an index with index mode set to `lookup` to be able use the LOOKUP JOIN filter in ES|QL, this looked like what had the most chance of working currently in integrations

I tried setting this in the manifest of one of the datastreams that need it :
```
.....
elasticsearch:
index_mode: "lookup"
.....
```
However this resulted in a lint error :

I tried changing it directly in the built .zip package and load it into Kibana but while the package loaded without any errors the index mode was not set to `lookup`

I then try this, again directly in the .zip :
```
elasticsearch:
index_template:
settings:
index:
mode: lookup
```
And this time I get the wanted result :

However when trying to do it the correct way via an elastic-package build I get :

Looking at the Go code this does not seem too hard to implement in the current state, however I am wondering why there is an higher level property index_mode as well as an index.mode property?

Just for the sake of curiosity could someone shed some light on this?

I will try to implement this feature, if it does not go against any behavior that people might have wanted to prevent