[FEATURE] Custom Rules - auto field mapping control

Is your feature request related to a problem?

Currently when user is ingesting custom rules, we're automatically rewriting rule field names based on mappings in fieldmappings.yml file. User is unaware if any of fields are actually rewritten, and if they are, there is no information to what exact field are they rewritten.

Example:

Let's say user has field called RunningProcessName in log index and user ingested and enabled custom rule which uses this field in selection query. If RunningProcessName is present in fieldmappings.yml for this particular rule category, Rule would be rewritten to mapped value without user knowledge and Rule won't be working.

What solution would you like?
When ingesting custom rules, make automatic field rewrite disabled by default. Possibly make this as a setting/checkbox on Rule create flow.

Start by tracing custom-rule ingestion and the Rule create flow, then inspect how fieldmappings.yml is applied during rule processing. Done means automatic field rewriting is disabled by default and the create flow provides the requested explicit control, with the resulting behavior verified for custom rules.