[Security Solution] Severity/Risk override does not work with arrays

[FrankHassanabad]

Describe the bug:

When the source index you are trying to create detections from has their severity or risk override contained in an array then they will not be correctly detected and the fallbacks of the non-overrides will end up taking effect.

Steps to reproduce:

1. Add a lightweight mapping and two record sets for this from dev tools:

# Mappings
PUT delme-test-overrides
{
  "mappings": {
    "dynamic": "strict",
    "properties": {
      "@timestamp": {
        "type": "date"
      },
      "severity_override": {
        "type": "keyword"
      },
      "risk_override": {
        "type": "integer"
      }
    }
  }
}

# Single values are going to work
PUT delme-test-overrides/_doc/1
{
 "@timestamp": "2020-11-02T22:24:49.337Z",
 "severity_override": "test_value_1",
 "risk_override": 1
}

# Multiple values in an array will not trigger the overrides
PUT delme-test-overrides/_doc/2
{
 "@timestamp": "2020-11-02T22:24:49.337Z",
 "severity_override": ["test_value_2", "test_value_3"],
 "risk_override": [1]
}

2. Create a rule that has a very large look back time like so below where it should detect both records and change both of their scores:

3. After running it, look at detections, put timeline in full screen mode, adjust your columns like I have below and you should see this:

Both those records should have overrides but only one does which is the bug. What gets a bit complicated is my second example where I put two override values together in an array. The higher severity version should be chosen and tested for. Also users sometimes can put duplicates in the array that we should test for and work with.

Current behavior:
Does not do the overrides

Expected behavior:
Should do the overrides

Kibana/Elasticsearch Stack version:
7.9.0

Server OS version:
any

Browser and Browser OS versions:
any

Elastic Endpoint version:
any

Original install method (e.g. download page, yum, from source, etc.):
dev box locally

Functional Area (e.g. Endpoint management, timelines, resolver, etc.):
detection engine

[banderror]

PRs:

-> 8.0.0 #83723
-> 7.11.0 #84643