[New Rule] Detect users authenticating with Okta to more than 10 unique apps within a 5 minute period

### Description

Detect users authenticating with Okta to more than 10 unique apps within a 5 minute period. This is meant to detect Discovery or Lateral Movement attempts.

This approach will be done with `count_distinct`, but at the cost of losing app details. A version with app details will be created as a hunt (#4100) until `values` is performant enough to create a prod rule with. This can also be done with a threshold rule, since `values` is still beta and considered risky for performance. (This could also be a threshold rule)

### Related rules

* 4edd3e1a-3aa0-499b-8147-4d2ea43b1613 okta Unauthorized Access to an Okta Application

### Target Ruleset

okta

### Target Rule Type

ES|QL

### Tested ECS Version

_No response_

### Query

```sql
from logs-okta*
| where event.action == "user.authentication.sso"
| stats total_apps = count_distinct(okta.target_app.display_name) by user.email
| where total_apps > 10
| sort total_apps desc
```

### New fields required in ECS/data sources for this rule?

_No response_

### Related issues or PRs

_No response_

### References

_No response_

### Redacted Example Data

_No response_