[BUG] Threat Intel Monitor is not clubbing matched doc-ids into Finding for same IoC because of fanout

Detector findings are group of rules that a doc id matches. Since doc level monitor distributed approach guarantees that only one node in one execution of a monitor sees a given doc, a unique finding is guaranteed

But threat intel monitor creates findings per Ioc and links doc ids that contain that ioc. So every single node in distributed execution can create a finding for an ioc and link unique doc ids but since threat intel finding is identified by Ioc value and nto a doc id there would be duplicate findings.

Potential solutions:

1. use locking mechanism to create finding. if finding exists, then update with doc ids

Start by tracing Threat Intel Monitor finding creation during distributed execution and how findings are identified by IoC value. Inspect the existing finding update or synchronization paths before choosing an approach. Done means concurrent nodes produce one finding per IoC containing all matching document IDs, with a regression test covering fanout.