[BUG] Incorrect type for Microsoft.SecurityInsights/threatIntelligence/main/queryIndicators keywords

### API Spec link

https://github.com/Azure/azure-rest-api-specs/blob/main/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2025-03-01/ThreatIntelligence.json#L890

### API Spec version

2025-03-01

### Describe the bug

https://github.com/Azure/azure-rest-api-specs/blob/main/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2025-03-01/ThreatIntelligence.json#L890
Specifies the keywords search param as a array of Strings. The API returns that this is invalid.

`{
"pageSize": 100,
"keywords": ["test"],
"sources": [
"analyst1_dev.local.analyst1.com"
],
"sortBy": [
{
"itemKey": "lastUpdatedTimeUtc",
"sortOrder": "descending"
}
]
}`

Yields
`{
"error": {
"code": "BadRequest",
"message": "JsonToken EndArray is not valid for closing JsonType Object. Path '', line 3, position 22.\nUnexpected character encountered while parsing value: [. Path 'keywords', line 3, position 15."
}
}`

Changing keywords to ids (which is also an array of strings) returns 200 response. I'm not sure what the correct type is but is seems to not be the documented one.

Tested with several api spec versions.

### Expected behavior

200 with response when a spec compliment message is sent

### Actual behavior

400 error
`{
"error": {
"code": "BadRequest",
"message": "JsonToken EndArray is not valid for closing JsonType Object. Path '', line 3, position 22.\nUnexpected character encountered while parsing value: [. Path 'keywords', line 3, position 15."
}
}`

### Reproduction Steps

POST https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/threatIntelligence/main/queryIndicators?api-version=2024-09-01
`{
"pageSize": 100,
"keywords": ["test"],
"sources": [
"analyst1_dev.local.analyst1.com"
],
"sortBy": [
{
"itemKey": "lastUpdatedTimeUtc",
"sortOrder": "descending"
}
]
}`

### Environment

_No response_

Start with ThreatIntelligence.json at the queryIndicators schema around line 890 and compare the documented keywords shape with the supplied POST request and error response. Check the related API versions and validation conventions in the securityinsights specification. Done means the specification matches the service’s accepted request shape and passes the repository’s specification checks.

Written by the indexing model from the issue text.