Add threat.technique.subtechnique

[rw-access]

Closes #867

For more context on why it makes sense to nest this at threat.technique.subtechnique, see #867 and the related Kibana issue.

I also updated the example information, since it was before ATT&CK added subtechniques, and I wanted to make sure everything was fully consistent with one example. PowerShell is one of my gotos (formerly T1086, now T1059.001).

• Have you signed the contributor license agreement? ✔️
• Have you followed the contributor guidelines? ✔️
• For proposing substantial changes or additions to the schema, have you reviewed the RFC process? N/A
• If submitting code/script changes, have you verified all tests pass locally using make test? ✔️
• If submitting schema/fields updates, have you generated new artifacts by running make and committed those changes? ✔️
• Is your pull request against master? Unless there is a good reason otherwise, we prefer pull requests against master and will backport as needed. ✔️
• Have you added an entry to the CHANGELOG.next.md? ✔️

[ebeahan]

I think this approach adding subtechnique underneath threat.technique and threat.technique.subtechnique having id, name, and reference as leaf fields makes sense. I also think making these changes in a PR (vs RFC) is also appropriate. Overall looks great! Thanks @rw-access! 👍

With the 1.6 release today, the CHANGELOG.next got updated to remove most of the previous entries. A rebase should fix the new merge conflict.

[ebeahan]

LGTM 👍