[New Rule] Suspicious Anonymous Windows Authentication

## Description
Detects anonymous connections from tools like Nessus and CrackmapExec that have similar characteristics in the event log data.

### Target indexes
logs-*

### Additional requirements
Audit logon events: Success, Failure

### Target Operating Systems
windows

### Tested ECS Version
8.0.0

### Query
```
event.code: 4624
winlog.event_data.TargetUserName: ANONYMOUS LOGON
winlog.event_data.KeyLength: 128
source.domain: -
```

### References
CrackMapExec syntax:
crackmapexec smb x.x.x.x

Nessus:
Run a default unauthenticated scan against the target IP

### Comments
I've never submitted a pull request so hopefully someone can pick this up or help me stumble through it. I've had the rule running in my production environment for about a month with no false positives.