[BUG] Findings history deleted by alert retention instead of finding retention

Description

Summary

Findings history indices are deleted based on alert_history_retention_period, not finding_history_retention_period.

In DetectorIndexManagementService, cleanup applies alert, finding, correlation, and IOC retention checks to every scanned index. A findings index has no alerts-history alias, so once it is older than alert retention it is marked for delete—even when finding retention is longer.

Steps to reproduce

1. Create a detector that generates findings.
2. Apply these cluster settings:

PUT _cluster/settings
{
  "persistent": {
    "plugins.security_analytics.finding_history_max_age": "2d",
    "plugins.security_analytics.finding_history_retention_period": "4d",
    "plugins.security_analytics.alert_history_retention_period": "2d"
  }
}

3. Generate findings and wait for the findings index to roll over after finding_history_max_age (2 days).
4. Wait until the rolled findings index is older than alert_history_retention_period (2 days), but still younger than finding_history_retention_period (4 days).
5. Check indices after the next cleanup job:

GET _cat/indices/.opensearch-sap-*-findings*?v

Example

1. Day 0 — findings index created
2. Day 2 — index rolls over (max_age)
3. Day 2+ — old findings index is deleted because age > alert retention (2d)

Result: findings are gone after ~2 days, not 4.

Expected behavior

• Findings indices are retained for finding_history_retention_period
• Alert history indices are retained for alert_history_retention_period
• Each history type uses only its own retention setting

Reference

For reference, this was the file I checked: src/main/java/org/opensearch/securityanalytics/indexmanagment/DetectorIndexManagementService.java.

Start with src/main/java/org/opensearch/securityanalytics/indexmanagment/DetectorIndexManagementService.java and trace the cleanup checks applied to scanned findings and alert history indices. Reproduce the four-day versus two-day retention scenario from the issue, then verify that each history type is deleted only according to its own retention setting.