[Security Solution] Add README and helper util functions for moving data to frozen quickly

[marshallmain]

Summary

For creating test data in frozen tier.

[nkhristinin]

Thanks for implementing that!

Probably we should mention that user need to register snapshot repository
https://docs.elastic.dev/security-soution/analyst-experience-team/eng-prod/how-to/configure-local-frozen-tier

Because I had a error before I did that.

Another thing, that I wanted to use it to test our _tier filters

But locally this request return 0 documents

GET my-data-stream/_search/
{
  "query": {
    "terms": {
      "_tier": [
        "data_frozen"
      ]
    }
  }
}

Another thing, that when I call

GET my-data-stream/_ilm/explain

It stuck in step

"step": "wait-for-index-color"

Do you have the same output?

[marshallmain]

Probably we should mention that user need to register snapshot repository
https://docs.elastic.dev/security-soution/analyst-experience-team/eng-prod/how-to/configure-local-frozen-tier

Good point, I was testing a cluster on cloud with real frozen nodes so that probably accounts for the differences. I added a few sentences to clarify the expected environment for these instructions and a link to those docs for local testing efforts.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: d3c414c

Metrics [docs]

✅ unchanged

History

• 💔 Build #251550 failed bc04404
• 💔 Build #251453 failed 44b1658
• 💚 Build #250466 succeeded 482a160
• 💚 Build #248821 succeeded fcd90f5
• 💔 Build #248444 failed 7aa0dfb