[New Rule] Mdfind Sensitive File Discovery

## Description

Detects the use of Mdfind binary to search the filesystem for sensitive files that may contain credentials. Threat actors can use mdfind to search and collect sensitive files or data on a compromised host.

### Target indexes

logs-*

### Target Operating Systems

macOS

### Tested ECS Version
1.11.0

### Query
```sql
process where event.type == "start" and process.name : "mdfind" and process.args : ("*confidential*", "*password*", "*passw*", "*key*", "*secret*", "*cookies*", "*AKIA*", "*token*", "*kdbx*") and not process.parent.executable : ("/usr/local/kolide/bin/launcher-updates/*/Kolide.app/Contents/MacOS/launcher", "/System/*") and not process.Ext.effective_parent.executable : "/System/*"
```

### References
https://objectivebythesea.org/v5/talks/OBTS_v5_cOwens_cRoss.pdf