[Google Threat Intelligence]: Add filestream collection for existing threat list data streams

### Integration Name

Google Threat Intelligence [packages/ti_google_threat_intelligence]

### User Goal

**Problem:** Customers running air-gapped deployments cannot use this integration. Every data stream is API-only, and in a disconnected environment there is no route to the GTI API. The data those customers do receive — threat lists delivered as files on disk — cannot be ingested by anything in the package.

**Enhancement:** Add a `filestream` input to the existing threat list data streams so file-delivered threat list data can be collected, alongside the current API collection.

The on-disk format is expected to differ from what the API returns, so this likely needs its own parsing and normalisation rather than reusing the CEL path as-is. The goal is that documents land against the existing `ti_google_threat_intelligence.*` mappings and work with the packaged dashboards and threat enrichment, regardless of how the data arrived. Samples of the file format are available internally for whoever picks this up.

### Existing Features

API-only collection (`input: cel`) across every data stream. The workaround for offline customers - Custom Logs (Filestream) plus a hand-written pipeline — loses the package's mappings, dashboards, threat enrichment and slows down data onboarding from GTI.