[New Rule] Potential iTerm2 Autolaunch Process Hijack

## Description

Detects the launch of a process from a script in the iTerm2 autolaunch directory indicative of persistence. The iTerm2
autolaunch directory allows scripts to be placed there and launched when iTerm2 starts up. This is a powerful form of
persistence as iTerm2 is generally granted extensive TCC exceptions providing vast access and privileges.

### Target indexes

logs-*

### Target Operating Systems

macOS

### Tested ECS Version
1.11.0

### Query
```sql
process where event.type : ("exec", "start") and
process.parent.executable: "/Applications/iTerm.app/Contents/MacOS/iTerm2" and
process.args : ("/Users/*/.config/iterm2/AppSupport/Scripts/*",
"/Users/*/Library/Application Support/iTerm2/Scripts/AutoLaunch/*",
"/Users/*/Library/Application Support/iTerm2/Scripts/AutoLaunch.scpt") and
not process.executable : ("/Applications/iTerm.app/Contents/MacOS/iTerm2", "/Users/*/Library/Application Support/iTerm2/iTermServer-*")
```

### References
https://theevilbit.github.io/beyond/beyond_0002/
https://github.com/elastic/endpoint-rules/blob/c3d745dded34ff824a5a16b1c29ad4a4f9d260e7/rules/persistence_iterm2_autolaunch_process.toml#L10