[New Rule] Kubernetes Secrets Enumeration

## Description

Kubernetes is an attacking vector that current there is no detection rules for. During my initial analysis I was able to create a KQL queries that can detect the following activity:

The purpose of this rule is to detect a user enumerating kubernetes secrets

## Required Info

### Target indexes

`filebeat-*` with `gcp` module having `audit` configured.

### Additional requirements

### Target Operating Systems

Kubernetes

### Platforms

Google Kubernetes Engine

### Tested ECS Version
1.8.0

## Optional Info

### Query

In this query I'm excluding any enumeration done by `system*` which could include the following:
- `system:serviceaccount:elastic-system:elastic-operator`
- `system:apiserver`
- `system:serviceaccount:default:ingress-controller-ingress-nginx-admission`
- `system:serviceaccount:kube-system:generic-garbage-collector`

Query

```
"query": {
"bool": {
"must": [],
"filter": [
{
"bool": {
"must_not": {
"bool": {
"should": [
{
"query_string": {
"fields": [
"gcp.audit.authentication_info.principal_email"
],
"query": "system*"
}
}
],
"minimum_should_match": 1
}
}
}
},
{
"range": {
"@timestamp": {
"gte": "2021-05-04T13:29:16.495Z",
"lte": "2021-05-05T13:29:16.495Z",
"format": "strict_date_optional_time"
}
}
},
{
"match_phrase": {
"event.module": "gcp"
}
},
{
"match_phrase": {
"gcp.audit.type": "type.googleapis.com/google.cloud.audit.AuditLog"
}
},
{
"match_phrase": {
"gcp.audit.method_name": "io.k8s.core.v1.secrets.get"
}
}
],
"should": [],
"must_not": [
{
"match_phrase": {
"gcp.audit.status.message": "PERMISSION_DENIED"
}
}
]
}
}
```

### New fields required in ECS/data sources for this rule?

### Related issues or PRs

Ready to create the necessary detection rule `toml` files

### References

https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging

## Example Data