[New Hunt] Detect users authenticating with Okta to more than 10 unique apps within a 5 minute period (with app details)

### Description

Detect users authenticating with Okta to more than 10 unique apps within a 5 minute period. This is meant to detect Discovery or Lateral Movement attempts.

This is being submitted as a hunt since `values` is still beta and considered risky for performance. A rule version using `count_distinct` (which loses app details) is being tracked under: #4099

### Related rules

* 4edd3e1a-3aa0-499b-8147-4d2ea43b1613 okta Unauthorized Access to an Okta Application

### Target Ruleset

okta

### Target Rule Type

ES|QL

### Query

```sql
from logs-okta*
| where event.action == "user.authentication.sso"
| stats unique_apps = mv_dedupe(values(okta.target_app.display_name)) by user.email
| eval total_apps = mv_count(unique_apps)
| where total_apps > 10
| sort total_apps desc
```

### New fields required in ECS/data sources for this rule?

_No response_

### Related issues or PRs

_No response_

### References

_No response_

### Redacted Example Data

_No response_