[FR][DAC] Consideration: expose kql parse parameters for custom rules validation

[brokensound77]

Note: this work will target the DAC-feature branch

related to #3407

---

This is a consideration and not a commitment to work at this point. We should review the feasibility and supportability. If it is doable and not deemed maintainable, we can move the example code to the DAC reference for users to manually implement.

---

Based on #3568, I will look at allowing normalization on KQL queries for custom rules and exposed in the config. (This allows uppercase operators)

#3407 (comment)

[eric-forte-elastic]

I think this is a result of the reversion of #3574. I think we just need a small PR to on the setting of a custom rule directory, set the normalization flag to be true instead of false.

[brokensound77]

upon further consideration and observations of how this should be leveraged, I don't think it should be default, but a config parameter. Noted in PR