[Rule Tuning] Suspicious Access to LDAP Attributes - Ignored Fields

### Link to Rule

https://github.com/elastic/detection-rules/blob/main/rules/windows/discovery_high_number_ad_properties.toml

### Rule Tuning Type

False Negatives - Enhancing detection of true threats that were previously missed.

### Description

We need to investigate the behavior of this rule when `winlog.event_data.Properties` is marked as ignored due to the length of the field. When a field is marked as ignored, you cannot query it using either KQL or EQL, but we should validate the behavior on ES|QL.

### Example Data

_No response_