[Security Solution][Detection Engine] Investigate ways to bound memory usage of rule queries

[marshallmain]

Parent issue: https://github.com/elastic/security-team/issues/10106

Detection rules typically fetch 100 source documents at a time to transform into alerts. When these source documents are large, this puts significant memory pressure on both Elasticsearch and Kibana. If the documents are large enough, Elasticsearch and/or Kibana can run out of memory and crash. We should investigate ways that we can limit the total amount of data retrieved at one time to avoid OOM problems.

[elasticmachine]

Pinging @elastic/security-detection-engine (Team:Detection Engine)