[FR] Switch Default Behavior to not allow uppercase KQL Keywords

[eric-forte-elastic]

Issues

#3573

Summary

We would like this uppercase conversion feature to be available for customers but internally we do not want it to be enabled by default.

See #3568 for more context. There should be 6 instances where we use kql.parse for creating/importing/testing/validation that we wish to revert. The only remaining case we want to keep is the unit test to make sure conversion functions as expected.

Testing

1. Modify an existing kuery rule to use uppercase keywords.
   E.g. modify the query for rules/integrations/gcp/defense_evasion_gcp_firewall_rule_created.toml to:

query = '''
event.dataset:gcp.audit AND event.action:(*.compute.firewalls.insert OR google.appengine.*.Firewall.Create*Rule)
'''

2. Run view rule for that rule.
   E.g. python -m detection_rules view-rule rules/integrations/gcp/defense_evasion_gcp_firewall_rule_created.toml
3. Run Unit Tests
4. Create a rule using python -m detection_rules create-rule with capital keywords
   E.g. event.dataset:gcp.audit AND event.action:(*.compute.firewalls.insert OR google.appengine.*.Firewall.Create*Rule)
5. Import a kuery rule with capital keywords via python -m detection_rules import-rules
   E.g.
   20240314T190337L.ndjson.txt

If all of these fail, then the behavior has been reverted successfully.

[brokensound77]

[Mikaayenson]

Lgtm!