Update the Security data ingest check in Discover for ES|QL mode #9181

Discover opens in ES|QL mode by default from 9.6 and in serverless (#8973). The "Verify that your data reaches Elastic Security" section of the Security data ingest page needs a closer look for ES|QL mode, beyond the simple query it has today.

Open points:

• Decide whether the second bullet, about the data view that Elastic Security uses not including a new index, needs an ES|QL equivalent or stays classic mode only. The bullet is about data views.
• Make the ES|QL check work for each way readers send data. The example for other methods uses filebeat-*, which fits Beats but not a custom index that Logstash or a third-party collector writes to.

Page: solutions/security/get-started/ingest-data-to-elastic-security.md

Related: #9017, #4898, #8973