[FR] Additional Unit Test For Placeholder Fields

## Summary
The investigation guides now leverage a new OSQuery variable feature to autofill from data within detection rule alert (e.g. {{file.name}}). We should add a unit test that checks for this note on investigation guires that use these placeholder fields.

Note:
- This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.

## References

- Similar to [this](https://github.com/elastic/detection-rules/blob/2ff4584456f984cde9b5c6f9b1b7ec7f6bf1e0eb/tests/test_all_rules.py#L1129) test
- [Investigation guide feature](https://github.com/elastic/detection-rules/pull/2943)