[New Hunt] Detect authentication to a new Okta app over the last 30 days

### Description

Detect users authenticating to a newly seen Okta app over the last 30 days. This is meant to detect Discovery or Lateral Movement attempts.

A new terms BBR version is being tracked here: #4101

_Note: the query logic below emulates new terms but with more control_

### Target Ruleset

okta

### Target Rule Type

ES|QL

### Tested ECS Version

_No response_

### Query

```sql
from logs-okta*
| where event.action == "user.authentication.sso"
| stats by user.email, okta.target_app.display_name, day=bucket(@timestamp, 1 day)
| eval today=to_datetime(concat(substring(to_string(now()), 0, 10), "T00:00:00.000Z"))
| eval seen_today=day == today
| stats seen=values(seen_today), total=count(okta.target_app.display_name) by user.email, okta.target_app.display_name
| where mv_count(seen) == 1 and seen
| sort user.email, okta.target_app.display_name
```

### New fields required in ECS/data sources for this rule?

_No response_

### Related issues or PRs

_No response_

### References

_No response_

### Redacted Example Data

_No response_