[SecuritySolution] Fix DNS histogram query

[angorayc]

Summary

This fix below query issues within DNS histogram:

1. The terms aggregates field should be dns.question.regustered_domain instead dns.question.domain

Steps to verify:

• Inspect the chart and observe the query should do terms aggregation on dns.question.regustered_domain

Known issue:
#154533

2. It didn't respect is PTR record included flag

Steps to verify:

• Switch the toggle in DNS tab to include PTR record
• Inspect the chart and observe the query should not exclude PTR record
• Click on Add to new Case / Add to existing Case / Open in Lens and observe the query should not exclude PTR record.

Screen.Recording.2023-04-06.at.12.40.56.mov

3. It didn't respect is PTR record included when feature flag chartEmbeddablesEnabled: is false

Steps to verify:

• Set chartEmbeddablesEnabled to false
• Switch the toggle in DNS tab to include PTR record
• Click on Add to new Case / Add to existing Case / Open in Lens and observe the query should not exclude PTR record.

Screen.Recording.2023-04-06.at.16.04.54.mov

After:

Screen.Recording.2023-04-06.at.12.30.40.mov

Checklist

Delete any items that are not applicable to this PR.

• Unit or functional tests were updated or added to match the most common scenarios

[elasticmachine]

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[kibana-ci]

💚 Build Succeeded

• Buildkite Build
• Commit: 568c4fb

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	15.9MB	15.9MB	+788.0B

Unknown metric groups

ESLint disabled line counts

id	before	after	diff
securitySolution	433	436	+3

Total ESLint disabled count

id	before	after	diff
securitySolution	513	516	+3

History

• 💔 Build #118556 failed 0e9f3b0
• 💛 Build #118397 was flaky 6fe4bdd
• 💔 Build #118386 failed 8bd7b3d
• 💔 Build #118283 failed 3164b53
• 💔 Build #118277 failed 84c7d2a

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[stephmilovic]

LGTM, thanks for catching this and for the thorough tests!