[Security Solution] [Exceptions] PUT api allows empty item_id but fails validation when fetching the associated list

[dhurley14]

Kibana version:
8.15.0 and below

Describe the bug:
If a customer updates an exception item using the PUT api and consequently sets the item_id to an empty string "", subsequent fetching of that exception item, or fetching the list the item is associated with, will fail validation and result in the UI displaying a 500 error toast.

Exceptions list view (exception lists are visible but toast appears):

---

Exception list details (list items are not rendered and toast appears):

Steps to reproduce:

1. Initialize detection engine (visit detection rules page)
2. Create a shared exception list
3. Create exception item
4. Follow the steps outlined below within Kibana Dev Tools

# find the list id
GET kbn:/api/exception_lists/_find

# find the list items
GET kbn:/api/exception_lists/items/_find?list_id=my-list-uuid

# Manipulate item_id to be the empty string for the given item
PUT kbn:/api/exception_lists/items
{
  "description": "Exception list item",
  "entries": [
    {
      "field": "host.foo",
      "operator": "included",
      "type": "exists"
    }
  ],
  "id": "my-item-uuid",
  "item_id": "", <---- empty list_id
  "name": "Test",
  "namespace_type": "single",
  "type": "simple"
}

Now when we try to fetch the exception list that contains the item with the empty item_id we will see the validation failure

# try to fetch the exception list again
GET kbn:/api/exception_lists/items/_find?list_id=my-list-uuid

which returns the validation error

{
  "message": "Invalid value \"\" supplied to \"data,item_id\"",
  "status_code": 500
}

Expected behavior:
Prevent the empty string from being accepted in the PUT route. A null value for item_id is disallowed in the PUT route and I believe the empty string should be treated similarly.

[dhurley14]

This is fixed on main by the changes in this PR: #185951 so any fixes for 8.15.x would be committed just for that release branch and can be skipped in main.

[elasticmachine]

Pinging @elastic/security-detection-engine (Team:Detection Engine)

[vitaliidm]

@dhurley14

I created 2 PRs

1. to fix it in 8.15, as you suggested - [Security Solution][Detection Engine] fixes empty item_id in exception item update request #194172
2. for 8.16, to fix schema itself in main. Because it is used in code.

I needed 2 PRs, so 8.15 could be tested before PR to main merged and backport created

[vitaliidm]

fixed in #194172