Determine alert count expected from signals(rules+docs) generated by geneve

[achuguy]

Need to examine the rules and docs generated by geneve for generating signals to determine how many expected alerts should be generated. Ideally this would be 1 alert per rule.

[cavokz]

The current implementation of the rules-load pipe works only if the rules are created before the documents are loaded. Indeed it deletes all the existing rules (if so is configured) and then create the new ones.

If the component is configured after the documents are uploaded, any existing rule in the cluster has time to run and trigger alerts.

In the Geneve unit tests, the rules are always deleted as first step, then documents are generated and loaded, then rules are eventually created.

I think that the step of deleting the rules should be moved in a pipe component on its own that is configured before documents and rules creation. It's a goal to leave the documents upload and rules upload order swappable. Once things are done in the proper order, then the count of alerts becomes predictable.

There is a caveat though, for some rules Geneve is not able to generate documents that would trigger them. These rules are known and are listed in the tests/reports/alerts_from_rules-*.md files.

[achuguy]

Moved rules deletion to a stack-cleanup stage with this pr https://github.com/elastic/tenex/pull/12