[New Integration] Snowflake

# Description
The Snowflake integration enables organizations to monitor and detect security threats within their Snowflake platform. By ingesting security-relevant logs and metrics from Snowflake's various monitoring tables, the integration provides comprehensive visibility into potentially suspicious activities across the Snowflake instance.

# Architecture

- The integration collects data from the following tables:
- [SNOWFLAKE.ACCOUNT_USAGE.LOGIN_HISTORY](https://docs.snowflake.com/en/sql-reference/account-usage/login_history)
- [SNOWFLAKE.ACCOUNT_USAGE.SESSIONS](https://docs.snowflake.com/en/sql-reference/account-usage/sessions)
- [SNOWFLAKE.ACCOUNT_USAGE.GRANTS_TO_USERS](https://docs.snowflake.com/en/sql-reference/account-usage/grants_to_users)
- [SNOWFLAKE.ACCOUNT_USAGE.ACCESS_HISTORY](https://docs.snowflake.com/en/sql-reference/account-usage/access_history)
- [SNOWFLAKE.ACCOUNT_USAGE.DATA_TRANSFER_HISTORY](https://docs.snowflake.com/en/sql-reference/account-usage/data_transfer_history)
- [SNOWFLAKE.ACCOUNT_USAGE.STAGES](https://docs.snowflake.com/en/sql-reference/account-usage/stages)
- [SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY](https://docs.snowflake.com/en/sql-reference/account-usage/query_history)
- [SNOWFLAKE.ACCOUNT_USAGE.EXTERNAL_ACCESS_HISTORY](https://docs.snowflake.com/en/sql-reference/account-usage/external_access_history)
- [Event tables](https://docs.snowflake.com/en/developer-guide/logging-tracing/event-table-columns)

Snowflake data can be loaded to Elastic via the [Snowpipe](https://docs.snowflake.com/en/user-guide/data-load-snowpipe-rest-overview) API.

# Dashboard Ideas
The dashboard should provide answers to questions about user data warehouse security posture, user activities and potential threats. It should enable real-time monitoring of access patterns, authentication attempts, and data usage across the Snowflake environment. These are a few key categories, and suggestions for potential charts which satisfy each category:

- Authentication & access overview
- Line graph showing login attempts over time
- Geo map of login locations and suspicious access patterns
- Heat map showing login activity by time of day/week
- Counter showing total active sessions and failed login attempts in last 24h

- User activity
- Table of top users by query volume
- Chart showing resource consumption by user/role
- Timeline of user permission changes
- Suspicious activity indicators (off-hours access, unusual query patterns)

- Data access patterns
- Bar chart of most frequently accessed tables/views
- Line graph showing data transfer volume trends
- Table of external data access events
- Alerts for unusual data access volumes or patterns
- Alerts on unauthorized stage access attempts

- Query analysis & security
- Chart showing distribution of query types
- Timeline of sensitive data access events
- Table of failed queries that might indicate attempted abuse
- Metrics on query performance and resource utilization

# Integration release checklist

This checklist is intended for integrations maintainers to ensure consistency
when creating or updating a Package, Module or Dataset for an Integration.

### All changes

- [ ] Change follows the [contributing guidelines](https://github.com/elastic/integrations/blob/main/CONTRIBUTING.md)
- [ ] Supported versions of the monitoring target are documented
- [ ] Supported operating systems are documented (if applicable)
- [ ] Integration or [System tests](https://github.com/elastic/elastic-package/blob/master/docs/howto/system_testing.md) exist
- [ ] Documentation exists, [useful guidelines](https://github.com/elastic/integrations/blob/main/docs/documentation_guidelines.md) to follow
- [ ] Fields follow [ECS](https://github.com/elastic/ecs) and [naming conventions](https://www.elastic.co/guide/en/beats/devguide/master/event-conventions.html)
- [ ] At least a manual test with ES / Kibana / Agent has been performed.
- [ ] Required Kibana version set to: