docs(mappers): time no longer dates detection

Eight mappers (Cortex XDR, CrowdStrike, Rapid7) still called the OCSF
`time` field "the MTTD anchor" that Riposte reads to stamp detected_at.
Riposte retired MTTD in migration 0256 and stamps detection at
ingestion for every alert; the mappings stay, as the alert's own record
of when the source saw the event. Comments only: no mapping changes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

integrations/rapid7-insightidr/mappers/query_log.yaml

@@ -41,9 +41,10 @@ ocsf:
   - { source_path: "detection_name", ocsf_field: "finding_info.title" }
   - { source_path: "detection_name", ocsf_field: "finding_info.analytic.name" }
   - { source_path: "$fromMillis(timestamp)", ocsf_field: "finding_info.created_time" }
-  # ── Detection time: the MTTD anchor ───────────────────────────────
-  # The log's own timestamp, not the poll's. A feed that ran late must not make the
-  # detection look late with it.
+  # ── Event time (OCSF `time`) ───────────────────────────────────────
+  # Riposte no longer reads it to date detection (MTTD retired, migration 0256):
+  # it is the alert's own record of when the source saw the event.
+  # The log's own timestamp, not the poll's.
   - { source_path: "$fromMillis(timestamp)", ocsf_field: "time" }
   # ── Product identity ──────────────────────────────────────────────
   - { source_path: "'Rapid7 InsightIDR'", ocsf_field: "metadata.product.name" }