[New Rule] Suspicious Spotlight Importer

## Description

Detects the creation of or modification of Spotlight Importers. This activity should be very rare and may indicate a threat attempting to persist via a malicious Spotlight Importer.

### Target indexes

logs-*

### Target Operating Systems

macOS

### Tested ECS Version
1.11.0

### Query
```sql
file where event.action != "deletion" and file.path : ("/System/Library/Spotlight/*", "/Library/Spotlight/*", "/Users/*/Library/Spotlight/*") and not file.path : "/Users/*/Library/Caches/*" and not process.code_signature.signing_id : ("com.apple.searchd", "com.apple.ditto")
```

### References
https://theevilbit.github.io/beyond/beyond_0011/