[8.7.0 release] Add 8.7.0 release notes (#2185)

* Add 8.7.0 release notes

* Format links

docs/release-notes/8.7.asciidoc

@@ -1,4 +1,37 @@
 [[ecs-release-notes-8.7.0]]
 === 8.7.0
 
-coming[8.7.0]
+[[schema-changes-8.7.0]]
+[float]
+==== Schema changes
+
+[[schema-bugfixes-8.7.0]]
+[float]
+===== Bugfixes
+
+* Remove duplicated `client.domain` definition {ecs_pull}2120[#2120]
+
+[[schema-added-8.7.0]]
+[float]
+===== Added
+
+* Adding `name` field to `threat.indicator` {ecs_pull}2121[#2121]
+* Adding `api` option to `event.category` {ecs_pull}2147[#2147]
+* Adding `library` option to `event.category` {ecs_pull}2154[#2154]
+
+[[schema-improvements-8.7.0]]
+[float]
+===== Improvements
+
+* Description for `host.name` definition updated to encourage use of FDQN {ecs_pull}2122[#2122]
+
+[[tooling-changes-8.7.0]]
+[float]
+==== Tooling and artifact changes
+
+[[tooling-improvements-8.7.0]]
+[float]
+===== Improvements
+
+* Updated usage docs to include `threat.indicator.url.domain` and changed `indicator.marking.tlp` and `indicator.enrichments.marking.tlp` from "WHITE" to "CLEAR" to align with TLP 2.0. {ecs_pull}2124[#2124]
+* Bump `gitpython` from `3.1.27` to `3.1.30` in `/scripts`. {ecs_pull}2139[#2139]