[Security Solution] Adds diff algorithm and unit tests for `data_sour…

…ce` field (#188874)

## Summary

Related ticket: #187659

Adds the diff algorithm and unit test coverage for the `data_source`
field we use in the prebuilt rules customization workflow. This field is
a custom grouped field that combines the `data_view_id` field and
`index_pattern` field that are used interchangeably of one another on
the rule type for a rule's data source.


### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios


### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

x-pack/plugins/security_solution/common/api/detection_engine/prebuilt_rules/model/diff/three_way_diff/three_way_diff_outcome.ts

@@ -7,6 +7,8 @@
 
 import { isEqual } from 'lodash';
 import { MissingVersion } from './three_way_diff';
+import type { RuleDataSource } from '../diffable_rule/diffable_field_types';
+import { DataSourceType } from '../diffable_rule/diffable_field_types';
 
 /**
  * Result of comparing three versions of a value against each other.
@@ -75,6 +77,33 @@ export const determineOrderAgnosticDiffOutcome = <TValue>(
   });
 };
 
+/**
+ * Determines diff outcome for `data_source` field
+ *
+ * NOTE: uses order agnostic comparison for nested array fields (e.g. `index`)
+ */
+export const determineDiffOutcomeForDataSource = (
+  baseVersion: RuleDataSource | MissingVersion,
+  currentVersion: RuleDataSource,
+  targetVersion: RuleDataSource
+): ThreeWayDiffOutcome => {
+  const isBaseVersionMissing = baseVersion === MissingVersion;
+
+  if (
+    (isBaseVersionMissing || isIndexPatternDataSourceType(baseVersion)) &&
+    isIndexPatternDataSourceType(currentVersion) &&
+    isIndexPatternDataSourceType(targetVersion)
+  ) {
+    return determineOrderAgnosticDiffOutcome(
+      isBaseVersionMissing ? MissingVersion : baseVersion.index_patterns,
+      currentVersion.index_patterns,
+      targetVersion.index_patterns
+    );
+  }
+
+  return determineDiffOutcome(baseVersion, currentVersion, targetVersion);
+};
+
 interface DetermineDiffOutcomeProps {
   baseEqlCurrent: boolean;
   baseEqlTarget: boolean;
@@ -121,3 +150,8 @@ export const determineIfValueCanUpdate = (diffCase: ThreeWayDiffOutcome): boolea
     diffCase === ThreeWayDiffOutcome.MissingBaseCanUpdate
   );
 };
+
+const isIndexPatternDataSourceType = (
+  version: RuleDataSource
+): version is Extract<RuleDataSource, { type: DataSourceType.index_patterns }> =>
+  version.type === DataSourceType.index_patterns;