chore: user_agent field fix in both the Azure AD authentication detections. Minor spelling mistake fixes.

[Shotscape]

Details:

The CIM compliant user_agent field was not being parsed correctly as the | rename properties.* as * line renames the field before the | rename properties.userAgent as user_agent line is able to rename it.

Updated some minor issues with the risk message and known false positive fields stating that the Azure AD High Number Of Failed Authentications For User search bin's every 5 minutes.

Lastly, fixed the word minutes being present twice in the risk message of the Azure AD High Number Of Failed Authentications From Ip search.

Checklist:

• Validate name matches <platform>_<mitre att&ck technique>_<short description> nomenclature
• CI/CD jobs passed ✔️
• Validated SPL logic.
• Validated tags, description, and how to implement.
• Verified references match analytic.
• Confirm updates to lookups are handled properly.

[nasbench]

The TA actually extracts user_agent from SignInLogs so no need for a rename anymore.

EVAL-user_agent = case(operationName IN ("Sign-in activity"),'properties.userAgent', \
                        true(),mvindex('properties.additionalDetails{}.value',mvfind('properties.additionalDetails{}.key',"^User-Agent$")))

You can see that even if a removed the rename the field is populated.

[nasbench]

Change LGTM

[patel-bhavin]

inspect failures are expected from forks! Thank you for the fixes @Shotscape