[FR] Update schema validation to use `data_stream.dataset`

[terrancedejesus]

Link to Kibana PR

No response

Feature Description

Confirmed with @andrewkroh that we should be using data_stream.dataset instead of event.dataset for integration schema validation for rule queries.

Per Andrew:

For Fleet managed data_streams, yes, rely on data_stream.dataset because it's always added by the Agent. And it is a constant_keyword so it should have better query performance.
event.dataset is mostly present in Fleet packages, but I don't think 100% have it. And it's not always a constant_keyword.

This was identified during rule creation for #4928 where event.dataset was not identified in the NPC events in TRADE's stack.

Desired Solution

Use data_stream.dataset instead of event.dataset for the validating rule query fields that are parsed.

Considered Alternatives

No response

Additional Context

• Slack thread