[8.18] [Security Solution] Reverts all remaining diff algorithm fields to return Target version when base version is missing (#214287) (#214515)

# Backport

This will backport the following commits from `main` to `8.18`:
- [[Security Solution] Reverts all remaining diff algorithm fields to
return Target version when base version is missing
(#214287)](https://github.com/elastic/kibana/pull/214287)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Davis
Plumlee","email":"56367316+dplumlee@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-03-14T07:20:37Z","message":"[Security
Solution] Reverts all remaining diff algorithm fields to return Target
version when base version is missing (#214287)\n\n##
Summary\n\nOriginally we had intended to have the prebuilt rule diff
algorithms\nmerge non-functional fields when the field's base version
was missing\nand a rule was marked as customized as described
in\nhttps://github.com/elastic/kibana/issues/210358\n\n> - When the rule
has a missing base version and is marked as\ncustomized:\n> - We should
attempt to merge all non-functional mergeable fields (any\nfield that
doesn't have consequences with how the rule runs e.g. tags)\nand return
them as SOLVABLE_CONFLICT\n\nWe ended up changing this logic to return
the `Target` version for every\nfield that fit that
description\n(https://github.com/elastic/kibana/pull/214161
and\nhttps://github.com/elastic/kibana/pull/213757) besides `tags` and
in\norder to support consistency rather than a very minor edge case, we
now\njust return the target version for every field with a missing
base\nversion and let users sort it out on their end\n\nThis PR reverts
the changes made to accommodate this edge case and\nupdates related
tests to account for the new logic\n\n### Checklist\n\nCheck the PR
satisfies following conditions. \n\nReviewers should verify this PR
satisfies this list as well.\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common
scenarios\n\n---------\n\nCo-authored-by: Georgii Gorbachev
<georgii.gorbachev@elastic.co>","sha":"a2d2054148b8cd7a062cfabd477338a3fd55428b","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security
Solution] Reverts all remaining diff algorithm fields to return Target
version when base version is
missing","number":214287,"url":"https://github.com/elastic/kibana/pull/214287","mergeCommit":{"message":"[Security
Solution] Reverts all remaining diff algorithm fields to return Target
version when base version is missing (#214287)\n\n##
Summary\n\nOriginally we had intended to have the prebuilt rule diff
algorithms\nmerge non-functional fields when the field's base version
was missing\nand a rule was marked as customized as described
in\nhttps://github.com/elastic/kibana/issues/210358\n\n> - When the rule
has a missing base version and is marked as\ncustomized:\n> - We should
attempt to merge all non-functional mergeable fields (any\nfield that
doesn't have consequences with how the rule runs e.g. tags)\nand return
them as SOLVABLE_CONFLICT\n\nWe ended up changing this logic to return
the `Target` version for every\nfield that fit that
description\n(https://github.com/elastic/kibana/pull/214161
and\nhttps://github.com/elastic/kibana/pull/213757) besides `tags` and
in\norder to support consistency rather than a very minor edge case, we
now\njust return the target version for every field with a missing
base\nversion and let users sort it out on their end\n\nThis PR reverts
the changes made to accommodate this edge case and\nupdates related
tests to account for the new logic\n\n### Checklist\n\nCheck the PR
satisfies following conditions. \n\nReviewers should verify this PR
satisfies this list as well.\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common
scenarios\n\n---------\n\nCo-authored-by: Georgii Gorbachev
<georgii.gorbachev@elastic.co>","sha":"a2d2054148b8cd7a062cfabd477338a3fd55428b"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/214287","number":214287,"mergeCommit":{"message":"[Security
Solution] Reverts all remaining diff algorithm fields to return Target
version when base version is missing (#214287)\n\n##
Summary\n\nOriginally we had intended to have the prebuilt rule diff
algorithms\nmerge non-functional fields when the field's base version
was missing\nand a rule was marked as customized as described
in\nhttps://github.com/elastic/kibana/issues/210358\n\n> - When the rule
has a missing base version and is marked as\ncustomized:\n> - We should
attempt to merge all non-functional mergeable fields (any\nfield that
doesn't have consequences with how the rule runs e.g. tags)\nand return
them as SOLVABLE_CONFLICT\n\nWe ended up changing this logic to return
the `Target` version for every\nfield that fit that
description\n(https://github.com/elastic/kibana/pull/214161
and\nhttps://github.com/elastic/kibana/pull/213757) besides `tags` and
in\norder to support consistency rather than a very minor edge case, we
now\njust return the target version for every field with a missing
base\nversion and let users sort it out on their end\n\nThis PR reverts
the changes made to accommodate this edge case and\nupdates related
tests to account for the new logic\n\n### Checklist\n\nCheck the PR
satisfies following conditions. \n\nReviewers should verify this PR
satisfies this list as well.\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common
scenarios\n\n---------\n\nCo-authored-by: Georgii Gorbachev
<georgii.gorbachev@elastic.co>","sha":"a2d2054148b8cd7a062cfabd477338a3fd55428b"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Davis Plumlee <56367316+dplumlee@users.noreply.github.com>

x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/diff/calculation/calculate_rule_fields_diff.ts

@@ -219,7 +219,7 @@ const commonFieldsDiffAlgorithms: FieldsDiffAlgorithmsFor<DiffableCommonFields>
   version: forceTargetVersionDiffAlgorithm,
   name: singleLineStringDiffAlgorithm,
   tags: createScalarArrayDiffAlgorithm({
-    missingBaseVersionStrategy: ScalarArrayDiffMissingBaseVersionStrategy.Merge,
+    missingBaseVersionStrategy: ScalarArrayDiffMissingBaseVersionStrategy.UseTarget,
   }),
   description: multiLineStringDiffAlgorithm,
   severity: singleLineStringDiffAlgorithm,

x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/prebuilt_rule_customization/customization_enabled/diffable_rule_fields/common_fields/tags.ts

@@ -297,11 +297,11 @@ export function tagsField({ getService }: FtrProviderContext): void {
             ruleUpgradeAssets,
             diffableRuleFieldName: 'tags',
             expectedDiffOutcome: ThreeWayDiffOutcome.MissingBaseCanUpdate,
-            isMergableField: true,
+            isMergableField: false,
             expectedFieldDiffValues: {
               current: ['tagB'],
               target: ['tagC'],
-              merged: ['tagB', 'tagC'],
+              merged: ['tagC'],
             },
           },
           getService