[Detection Engine][FTR] Audit machine learning FTRs

[yctercero]

Summary

We've been working on an effort to move our FTR tests from being run in trial license (an elevated license) to basic license/essentials tier. Tests in the elevated license folder should be specific to functionality only available for that license. During this work, I encountered a few behaviors that I think we need to follow up on.

ML is available in Essentials Tier in serverless, and Platinum in ESS. I think we can maintain the bulk of the ML tests in the trial_license_complete_tier folder but also add:

• Test passed creating ML rule in serverless essentials license. @paulewing @approksiu should this match ESS where this is only for elevated tier? EDIT: confirmed it should be available in essentials.
• Test in essentials tier ensuring you can create and run an ML rule - Serverless specifc
• Missing test in basic to ensure that if you downgrade, can’t run ML rules that already exist in ESS
• ML trial tier asset criticality test failing - search for this ticket number in the code

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-detection-engine (Team:Detection Engine)