Adding risk data model validation to integration testing

[cmcginley-splunk]

Context

• ES 8+ now allows notables (Findings) to have risk data associated with them
• We have TTP detections which generate both risks and notables, so we want to ensure risk data is only being associated with risks in this case to avoid risk score doubling
• We also have Correlation detections which generate notables alone (often based on an aggregation of existing risk entities); as of now, we don't define any risk modifiers for these, so we wouldn't expect them to be associated w/ risk data
• It's possible that ESCU's behavior in the future may change, but as of now, we do not expect ESCU detections to generate notables which appear in the risk data model

Code changes

• Added new methods to CorrelationSearch class which retrieves events from the risk data model
• During notable validation, risk data model is checked to ensure no notables appear in there
• New base class added to support notable and risk events

Testing

• TODO

TODOs

• disable logging
• address outstanding in-line TODOs

[pyth0n1c]

I am going to switch this to False.
But we should probably consider exposing ALL logging and verbosity as a common setting somewhere (possibly in contentctl.yml or the command line) since as we add more and more of it, it can be extremely useful

[pyth0n1c]

I made two additional small changes to bump the version and disable logging.
Given those are small changes, I will approve and merge myself.