[docs-patrol] Update CI and GTI docs for recent workflow and interval behavior changes

Recent code changes in the repository have introduced documentation drift. The following changes need corresponding documentation updates.

## Changes Requiring Documentation Updates

### 1. Document the new Security-ML package test workflow in CI docs

**Commit(s):**
- [`a09dcf0cf372ea50115f2fdd48a64c84be13a506`](https://github.com/elastic/integrations/commit/a09dcf0cf372ea50115f2fdd48a64c84be13a506)

**What changed:**
- Added a new GitHub Actions workflow at `.github/workflows/trigger-package-tests-security-ml.yml` that runs on PRs to `main` for changes under `packages/{beaconing,ded,dga,hta,lmd,pad,problemchild}/**` and dispatches `itp-dispatch-integrations.yml` in `elastic/security-ml`.

**Documentation impact:**
- `docs/ci_pipelines.md` currently states it describes CI pipelines in this repository and lists only Buildkite pipelines (`docs/ci_pipelines.md:1-12`).
- Add a section documenting this GitHub Actions-based CI path, including:
- when it triggers,
- package scope,
- same-repo-only/fork behavior (`if: github.event.pull_request.head.repo.full_name == github.repository`), and
- the external dispatch/check implication for PR contributors.

### 2. Update GTI README interval guidance after availability-delay guard change

**Commit(s):**
- [`cf9bd947e5c453a571955774f9df756d9c92bbe9`](https://github.com/elastic/integrations/commit/cf9bd947e5c453a571955774f9df756d9c92bbe9)

**What changed:**
- Threat-list streams now enforce an availability-delay guard in CEL and explicitly support safe `1h` polling (`packages/ti_google_threat_intelligence/data_stream/cryptominer/manifest.yml:17-30`, mirrored across threat-list streams).

**Documentation impact:**
- `packages/ti_google_threat_intelligence/docs/README.md` still instructs users that initial interval and interval should be hourly values and that initial interval must be greater than 2 hours (`README.md:58-60`), and troubleshooting repeats that constraint (`README.md:166`).
- Update this guidance to reflect current behavior (availability-delay guarded polling) and remove outdated strict interval wording.

## Suggested Actions

- [ ] Update `docs/ci_pipelines.md` with the Security-ML GitHub Actions workflow details and trigger semantics.
- [ ] Update `packages/ti_google_threat_intelligence/docs/README.md` interval/troubleshooting guidance to match the post-`cf9bd947e5` behavior.

> [!NOTE]
>
> 🔒 Integrity filter blocked 1 item
>
> The following item were blocked because they don't meet the GitHub integrity level.
>
> - [#18777](https://github.com/elastic/integrations/pull/18777) `search_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
>
> To allow these resources, lower `min-integrity` in your GitHub frontmatter:
>
> ```yaml
> tools:
> github:
> min-integrity: approved # merged | approved | unapproved | none
> ```
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Docs Patrol](https://github.com/elastic/integrations/actions/runs/26221865532)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on May 28, 2026, 11:12 AM UTC