[ti_opencti] Fix multi-value filter fields rendered as strings instead of YAML lists

[kcreddy]

Proposed commit message

[ti_opencti] Fix multi-value filter fields rendered as strings instead of YAML lists

The Handlebars template for the indicator data stream used bare
{{var}} substitution for six multi-value filter fields (pattern_types,
indicator_types, label_ids, author_ids, creator_ids, marking_ids).
When Fleet passes multiple values, JavaScript's Array.toString()
serialises them as a comma-separated string, so CEL state receives a
single string instead of a list. This causes the OpenCTI GraphQL API
to silently return zero results.

Replace bare {{var}} with {{#each}} iteration to render each value as
a separate YAML list item, matching the pattern used by other CEL
integrations.

Add policy tests covering both default and multi-value configurations
to prevent regression.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

Added policy tests with multi-valued fields pass and render correctly.

--- Test results for package: ti_opencti - START ---
╭────────────┬─────────────┬───────────┬───────────────────────┬────────┬───────────────╮
│ PACKAGE    │ DATA STREAM │ TEST TYPE │ TEST NAME             │ RESULT │  TIME ELAPSED │
├────────────┼─────────────┼───────────┼───────────────────────┼────────┼───────────────┤
│ ti_opencti │ indicator   │ policy    │ test-default.yml      │ PASS   │ 12.818391375s │
│ ti_opencti │ indicator   │ policy    │ test-multi-values.yml │ PASS   │ 11.053741417s │
╰────────────┴─────────────┴───────────┴───────────────────────┴────────┴───────────────╯
--- Test results for package: ti_opencti - END   ---
Done

Example:

            author_ids:
                - 11111111-2222-3333-4444-555555555555
                - 66666666-7777-8888-9999-000000000000

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

��� Build Succeeded

• Buildkite Build
• Commit: be22de3

cc @kcreddy

[elastic-vault-github-plugin-prod]

Package ti_opencti - 2.14.1 containing this change is available at https://epr.elastic.co/package/ti_opencti/2.14.1/