[SECURITY SOLUTION] Timeline query should not use _source

[MadameSheema]

Originally reported by: @XavierM

We need to refactor our timeline query to not use _source but fields like here. Therefore, will be able to use runtime fields.

We will take advantage of this to fix nested and multi Fields

GET _search
{
  "query": {
    "match_all": {}
  }
}
PUT test2
PUT test2/_mapping
{
    "dynamic": false,
      "properties": {
        "myErrorObjectField": {
          "properties": {
            "message":  { "type": "text" },
            "code": { "type": "keyword" }
          }
        },
        "my.dotted.field": {
          "type": "keyword"
        },
        "myNestedUserField": {
          "type": "nested"
        },
        "myLongField": {
          "type": "long"
        },
        "@timestamp": {
          "type": "date"
        },
        "message": {
          "type": "text"
        },
        "myMultiField": {
          "type": "long",
          "fields": {
            "float": {
              "type": "float"
            },
            "str": {
              "type": "keyword"
            }
          }
        }
      }
}
POST test2/_doc
{
  "myLongField": 400,
  "myMultiField": 49.5,
  "message": "message1",
  "myUnmappedMessage": "i am not mapped",
  "@timestamp": "2020-10-01T12:10:30Z",
  "myNestedUserField": [
    {
      "first" : "F",
      "last" :  "Bar"
    },
    {
      "first" : "A",
      "last" :  "W"
    }
  ],
  "my.dotted.field": "hi",
  "myErrorObjectField": [
    {
      "message": "hi",
      "code": "500"
    },
    {
      "message": "not found",
      "code": "400"
    }
    ]
}

[patrykkopycinski]

@XavierM I believe we can close this issue, right?