[New Rule] Excessive apps installed in Slack over short duration

### Description

An excessive amount of apps were installed in Slack over short duration by a single user, which could indicate attempts to perform recon, discover, collect, or laterally move.

### Target Ruleset

other

### Target Rule Type

Threshold

### Tested ECS Version

_No response_

### Query

* index pattern: `* logs-slack.audit*`
* query
```sql
event.action:app_installed and slack.audit.entity.name:* and user.full_name:*
```
* threshold: `more than 5 unique installs of slack.audit.entity.name and user.full_name` over `30m` lookback, with an interval of `35m`

### New fields required in ECS/data sources for this rule?

`slack.*`

### Related issues or PRs

_No response_

### References

https://api.slack.com/admins/audit-logs-call#app

### Redacted Example Data

_No response_