[Custom Threat Intelligence] Enrich indicators from related STIX objects (threat-actor attribution) instead of discarding them

## Summary

The Custom Threat Intelligence integration (`ti_custom`) currently only processes STIX 2.x objects of `type: "indicator"`. When a provider returns a STIX bundle that includes related objects (such as `threat-actor`, `relationship`, and `marking-definition`), those objects are discarded before indexing. This means contextually valuable intelligence — like the threat-actor attribution for an indicator — is silently lost.

This behavior is controlled by the `restrict_stix: true` configuration flag in the integration's ingest pipeline.

## Current Behavior

When a STIX 2.1 bundle is returned by the provider (e.g., Group-IB), it may contain multiple object types in a single response:

```json
{
"objects": [
{ "type": "indicator", "id": "indicator--90887e96-...", "pattern": "..." },
{ "type": "threat-actor", "id": "threat-actor--33c317d3-...", "name": "DragonOK" },
{ "type": "relationship", "relationship_type": "indicates", "source_ref": "indicator--90887e96-...", "target_ref": "threat-actor--33c317d3-..." },
{ "type": "marking-definition", "name": "TLP:AMBER" }
]
}
```

Only the `indicator` object is indexed. The `threat-actor` name (`DragonOK`) and its relationship to the indicator are dropped, and `event.original` contains no trace of them.

The root cause was identified in the agent diagnostics — the integration is configured with `restrict_stix: true`:

```yaml
fields:
_conf:
ioc_expiration_duration: 90d
restrict_stix: true
```

This flag explicitly limits processing to STIX `indicator` type objects, with no option to also traverse and enrich from related object types.

## Expected Behavior

The integration should either:

- Provide a complementary flag (e.g., `enrich_from_relationships: true`) that enables traversal of STIX `relationship` objects within the bundle to enrich indicator documents with data from linked objects such as `threat-actor`, **or**
- Extend `restrict_stix` to accept a list of allowed object types rather than a binary on/off, giving users control over what gets indexed and enriched

At minimum, `threat-actor` should be supported. For the example above, the resulting indicator document should include:

```json
{
"threat.indicator.name": "...",
"threat.group.name": "DragonOK"
}
```

## Motivation / Use Case

Threat-actor attribution is a core part of threat intelligence analysis. Providers like Group-IB bundle `threat-actor` objects alongside indicators in every API response precisely because the attribution is inseparable from the indicator's intelligence value. Discarding it silently at ingestion time means analysts lose context they need for triage, hunting, and detection tuning — with no indication that the data was ever there.

## Proposed Solution

When processing a STIX bundle with `restrict_stix: true`, the integration should:

1. Index all objects of `type: "indicator"` as today
2. Optionally (when enabled), build a local map of all other objects in the bundle, keyed by their `id`
3. For each `relationship` object, resolve the `source_ref` → `target_ref` linkage
4. Enrich the indicator document with fields from the linked object (e.g., map `threat-actor.name` → `threat.group.name` per ECS)

At minimum, `threat-actor` should be supported. Support for `malware`, `campaign`, and `intrusion-set` objects would further close the gap.

## References

- [STIX 2.1 Relationship Object spec](https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_e2e1szrqfoan)
- [ECS `threat.group` fields](https://www.elastic.co/guide/en/ecs/current/ecs-threat.html)

Start at the ti_custom ingest pipeline and the restrict_stix configuration described in the issue; trace where non-indicator STIX objects are discarded. Define the relationship traversal and threat-actor-to-threat.group mapping, then verify that indicator documents retain the existing fields while including linked attribution and event.original preserves the bundle context.

Written by the indexing model from the issue text.