Elastic Defend Service Enhancement

*"Elastic Defend scan response action should include scan statistics in the response payload: files scanned count, threats detected count, and scan duration breakdown." in Kibana
*
Reference the field path where it should appear:

EndpointActions.data.output.content.files_scanned
EndpointActions.data.output.content.threats_found

Reason: We need to collect evidence as how many files were scanned by Elastic defend.
how many threats detected per host.
How much time it took to complete the OnDemand scan.

Start in Kibana's Elastic Defend scan response handling and trace the EndpointActions.data.output.content payload. Confirm where files_scanned, threats_found, and scan duration should be populated, then verify that an OnDemand scan response exposes file counts, threat counts per host, and duration information.

Written by the indexing model from the issue text.