[Entity Store] Drop Okta name fragments from related.user alias resolution

[maxcold]

Summary

Fixes #278418.

The related_user_alias_resolution bridge rule reads a seed's related.user list and links entities whose identity fields match those values. Okta's ingest pipeline appends personal name fragments (first_name, last_name, middle_name, nick_name) into related.user, which are far more collision-prone than stable identifiers and can create false alias links between unrelated people who share a common name.

This change extends the existing Okta exclusion path (already used for manager fields) so those name-fragment source values are dropped before candidate lookup. Display name is intentionally kept for display-name bridging.

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
• This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
• Flaky Test Runner was used on any tests changed
• The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
• Review the backport guidelines and apply applicable backport:* labels.

Identify risks

Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss.

Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging.

• False-negative alias links (low): Dropping name fragments means we no longer bridge solely on bare given/family/nick names. Mitigation: identifiers (user.id, login, email) and display name remain; the rule is still OFF by default. Severity: low — preferred over false-positive links across unrelated people.

[infra-vault-gh-plugin-prod]

🤖 Jobs for this PR can be triggered through checkboxes. 🚧

ℹ️ To trigger the CI, please tick the checkbox below 👇

• Click to trigger kibana-pull-request for this PR!
• Click to trigger kibana-deploy-project-from-pr for this PR!
• Click to trigger kibana-deploy-cloud-from-pr for this PR!
• Click to trigger kibana-entity-store-performance-from-pr for this PR!
• Click to trigger kibana-storybooks-from-pr for this PR!

[kibanamachine]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: c5771b4
• Build duration: 74 mins

Failed CI Steps

• Scout Lane #2 - stateful-classic / default

Test Failures

• [job] [logs] Scout Lane #2 - stateful-classic / default / local-stateful-classic - Entity attachment cases – flyout add-to-case actions and Entities accordion - Entities accordion renders when entity attachments were added via API
• [job] [logs] Scout Lane #2 - stateful-classic / default / local-stateful-classic - Entity attachment cases – flyout add-to-case actions and Entities accordion - renders no Entities accordion when a case has no entity attachments

Metrics [docs]

✅ unchanged