[New Rule][BBR] A user logged into Slack from a new country

### Description

Detects when a user logs into a newly seen country over the last 30d, which could potentially indicate account compromise.

Ref internal: `540bc789-be24-4dbc-970c-a16489661290`

### Target Ruleset

other

### Target Rule Type

New Terms

### Tested ECS Version

_No response_

### Query

* index: `logs-slack.audit`
* query:

```sql
event.action:user_login and source.ip:* and user.email:* and source.geo.country_iso_code:*
```

* new terms: `user.email`, `source.geo.country_iso_code`
* timing: 30m lookback, 15m interval, 30d history window

### New fields required in ECS/data sources for this rule?

_No response_

### Related issues or PRs

_No response_

### References

https://api.slack.com/admins/audit-logs-call

### Redacted Example Data

_No response_