feat: add brute force login detection (T1110)

[clivoa]

Summary

• Adds detection for brute force login attempts via Windows Event 4625
• Triggers when an account accumulates ≥10 failed auth events within a 5-minute window
• Maps to MITRE ATT&CK T1110.001 (Password Guessing) and T1110.003 (Password Spraying)
• Status: testing — disabled in Splunk until validated in the environment

Detection logic

Buckets Event 4625 in 5-minute windows and counts failed attempts per account.
Risk level is assigned based on volume: ≥50 → critical, ≥20 → high, else medium.

Test plan

• CI Validate Changed Detections check passes
• Schema validation passes
• SPL syntax check passes against local Splunk
• Review detection logic and thresholds