[Entity Store] Use seed as related.user alias resolution target

[maxcold]

Summary

Fixes related.user alias resolution target selection so the seed IDP entity always becomes the resolution target, instead of namespace-priority selection (AD > Okta > Entra ID).

Previously, when Entra ID (or another lower-priority IDP) asserted cross-system aliases via related.user, Active Directory could still win as the golden/target entity. The seed is the data-driven authority because it is the IDP that declared the aliases.

Resolves the "target-direction product confirm" open item from the QA report in #275776.

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
• This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
• Flaky Test Runner was used on any tests changed
• The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
• Review the backport guidelines and apply applicable backport:* labels.

Identify risks

Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss.

Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging.

• See some risk examples
• Behavior change in alias target direction (medium). Existing related.user resolution groups that previously preferred AD via namespace priority will now prefer the asserting seed IDP. Mitigated by unit coverage for seed-vs-higher-priority-candidate, and scoped only to the default-off related_user_alias_resolution maintainer (email automated-resolution unchanged).

[infra-vault-gh-plugin-prod]

🤖 Jobs for this PR can be triggered through checkboxes. 🚧

ℹ️ To trigger the CI, please tick the checkbox below 👇

• Click to trigger kibana-pull-request for this PR!
• Click to trigger kibana-deploy-project-from-pr for this PR!
• Click to trigger kibana-deploy-cloud-from-pr for this PR!
• Click to trigger kibana-entity-store-performance-from-pr for this PR!
• Click to trigger kibana-storybooks-from-pr for this PR!