[New Rule] Azure AD Multiple MFA Sign-in Failures For Single User

## Description
A rule that detects multiple Azure AD MFA Sign-in failures (>1 in specified time frame [6h in attached rule]). The detected behavior may represent an adversary who has obtained legitimate credentials for a user and continuously repeats login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls potentially resulting in the user finally accepting the authentication request. Threat actors like the Lapsus team and APT29 have leveraged this technique to bypass multi-factor authentication controls. Azure AD error code is 500121.

ATT&CK tactic: Credential Access (TA0006)
ATT&CK technique: Multi-Factor Authentication Request Generation (T1621)

### Target indexes
logs-azure.signinlogs-*

### Additional requirements
Azure Active Directory integration

### Target Operating Systems
All OS

### Platforms
Azure Active Directory

### Tested ECS Version
8.4.1

### Query
event.action : "Sign-in activity" and azure.signinlogs.result_type : "500121" and not azure.signinlogs.properties.authentication_details.succeeded : true

### New fields required in ECS/data sources for this rule?
No

### Related issues or PRs
None

### References
https://attack.mitre.org/techniques/T1621/
https://www.mandiant.com/resources/blog/russian-targeting-gov-business
https://arstechnica.com/information-technology/2022/03/lapsus-and-solar-winds-hackers-both-use-the-same-old-trick-to-bypass-mfa/
https://therecord.media/russian-hackers-bypass-2fa-by-annoying-victims-with-repeated-push-notifications/

## Example Data