[Security Solution][Detection Engine] adds ftr tests that cover synthetic source behaviour different to stored source

[Security Solution][Detection Engine] adds ftr tests that cover synthetic source behaviour different to stored source #178683