[New Rule][BBR] Detect authentication to a new Okta app over the last 30 days

### Description

Detect users authenticating to a newly seen Okta app over the last 30 days. This is meant to detect Discovery or Lateral Movement attempts.

An ES|QL hunt version is being tracked here: #4102

### Target Ruleset

okta

### Target Rule Type

New Terms

### Tested ECS Version

_No response_

### Query

```sql
event.action:"user.authentication.sso"
```

New terms
`user.email, okta.target_app.display_name`

### New fields required in ECS/data sources for this rule?

_No response_

### Related issues or PRs

_No response_

### References

_No response_

### Redacted Example Data

_No response_