[Connector specs] Proposal to contribute an ANY.RUN TI Lookup connector

### What?

ANY.RUN would like to contribute a new spec-based TI Lookup connector to Kibana.

We are not requesting Elastic to implement this connector. ANY.RUN will provide the implementation, automated tests, end-user documentation, an official icon, live API validation, and vendor-side engineering support.

The purpose of this issue is to confirm that the proposed connector is acceptable for inclusion in Kibana and to agree on its architecture and initial scope before opening a pull request.

### Proposed connector

Proposed connector ID:

`.anyrun-ti-lookup`

Proposed source location:

`src/platform/packages/shared/kbn-connector-specs/src/specs/anyrun_ti_lookup`

The connector would use the ANY.RUN API and API-key
authentication. The API key would be stored as a Kibana connector secret

### Proposed actions

The initial implementation would provide the following actions:

- `lookupHash` — look up an MD5, SHA-1, or SHA-256 file hash.
- `lookupIp` — look up an IPv4 or IPv6 address.
- `lookupDomain` — look up a domain name.
- `lookupUrl` — look up a URL.

### Proposed output

Each action would have explicit typed input and output schemas so that its results can be used directly in Kibana Workflows.

The normalized output would include fields such as:

- `found`
- `verdictLabel`
- `threatLevel`
- `lastSeen`
- `tags`
- `relatedFiles`
- `relatedIps`
- `relatedDomains`
- `relatedUrls`
- `relatedTasks`

### Included in the initial scope

- API-key authentication
- Connector connectivity testing
- File hash lookup
- IP address lookup
- Domain lookup
- URL lookup
- Input validation
- Explicit typed input and output schemas
- Response normalization
- Sanitized error handling
- End-user documentation

### Why?

Elastic Security analysts frequently need to investigate file hashes, IP addresses, domains, and URLs found in detection alerts, cases, endpoint telemetry, and network events.

The connector would give Elastic users native access to ANY.RUN TI Lookup through typed, reusable Kibana Workflow actions. Analysts could enrich indicators, use normalized results in subsequent automation steps, simplify Workflow authoring, and keep the entire enrichment process within Elastic.

### Example use case

#### Enrich an indicator from an Elastic Security alert

1. A detection rule produces an alert containing a file hash, IP address,
domain, or URL.
2. A Kibana Workflow extracts the indicator.
3. The Workflow calls the relevant ANY.RUN TI Lookup action.
4. The connector returns a normalized verdict, threat level, tags, and related
entities.
5. Subsequent Workflow steps can add context to a case, tag the alert, save the
result to Elasticsearch, or route the alert for further investigation.

### Acceptance Criteria

**Happy path**

- [ ] A spec-based connector with an approved unique connector ID is registered
in Kibana.
- [ ] A user with the required connector privileges can configure the
connector using an ANY.RUN API key.
- [ ] The connector provides an enabled connectivity test.
- [ ] The connectivity test succeeds with a valid API key.
- [ ] `lookupHash` successfully looks up supported MD5, SHA-1, and SHA-256
values.
- [ ] `lookupIp` successfully looks up valid IPv4 and IPv6 addresses.
- [ ] `lookupDomain` successfully looks up a valid domain.
- [ ] `lookupUrl` successfully looks up a valid URL.
- [ ] Workflow authors can discover and reference normalized output fields such
as `found`, `verdictLabel`, and `threatLevel`.
- [ ] Every action can be executed successfully from a Kibana Workflow.
- [ ] The connector has an official production-ready ANY.RUN icon.
- [ ] End-user documentation describes configuration, actions, inputs, outputs and Workflow usage.

### Priority

Important (workaround exists)

### Blocked By

_No response_

### Additional Context

We currently have a working proof of concept implemented and tested against
Kibana 9.4.x.

The proof of concept includes:

- API-key authentication;
- `lookupHash`;
- `lookupIp`;
- `lookupDomain`;
- `lookupUrl`;
- input validation;
- response normalization;
- typed Workflow-oriented outputs;
- execution from Kibana Workflows.

ANY.RUN will provide the connector implementation, documentation, test credentials for the review process, and engineering support during review.

### Vendor resources

- [ANY.RUN TI Lookup](https://any.run/threat-intelligence-lookup/)
- [ANY.RUN TI Lookup API documentation](https://any.run/api-documentation/#tag/ti-lookup/POST/intelligence/api/search)

Start by reviewing the proposed source location, src/platform/packages/shared/kbn-connector-specs/src/specs/anyrun_ti_lookup, and the existing spec-based connector architecture. Compare the proof of concept and ANY.RUN API documentation with the acceptance criteria; done means an approved connector ID, working authentication and connectivity testing, all four lookup actions, typed normalized outputs, tests, icon, and documentation.

Written by the indexing model from the issue text.