Migrate integration testing to RBA paradigm - Step 2

[cmcginley-splunk]

Context

• Lou has made some significant changes to risk objects in DRAFT: new RBA Object - Step 3 - ESCU 5.0 #263
• This PR accommodates those changes in integration testing

Code changes

• Removed references to observables and adapted as appropriate for the new .rba structure
• Role checking removed from risk validation as it is no longer relevant in this new paradigm

Testing

• Spot checking against detections/endpoint/anomalous_usage_of_7zip.yml
• Integration testing passed
• Also contrived the following error scenarios and validated all were still caught
  • RBA does not exist -> functionally impossible as this is checked in validation
  • Two risk objects w/ the same field name
  • Unmatched risk object
  • Unmatched risk event
  • Unmatched analytic stories
  • Unmatched MITRE IDs
  • Pattern match failure on message string
  • Type mismatch on RBA object and risk event
  • Score mismatch RBA object and risk event
  • Field token in message string

[pyth0n1c]

I have only looked so far from a static perspective and didn't have any additional comments.
I haven't had the chance to do any runtime testing yet and anticipate I will get to this first thing Friday morning.