[New hunt] GenAI agent invocation burst (possible reasoning-loop exhaustion or rapid multi-turn probing)

**Description**

The repo's existing `aws_bedrock_dos_resource_exhaustion_detection.toml` hunting query only flags a small number of requests with unusually high token counts (>8000 tokens each). It has no signal for the opposite pattern: many small requests in a tight time window for one conversation, which is what an agent's internal tool-calling reasoning loop (or a rapid multi-turn probing/escalation attempt) actually produces. Real Bedrock data from this project's red-team testing shows two conversations with 5 Converse invocations each within 8-11 seconds; every individual call was well under the 8000-token threshold, so the existing query would not have flagged either.

**Target Huntset**: apm

**Target hunt Type**: ES|QL

**Query**
```sql
FROM traces-apm*, logs-*genai*
| WHERE @timestamp > NOW() - 15 MINUTES AND gen_ai.conversation.id IS NOT NULL
| STATS request_count = COUNT(*), first_ts = MIN(@timestamp), last_ts = MAX(@timestamp) BY gen_ai.conversation.id
| WHERE request_count >= 4
| SORT request_count DESC
```

**Related issues or PRs**

Companion to the indirect-prompt-injection-to-tool-invocation hunt submitted in this same batch.

**References**
- https://atlas.mitre.org/techniques/AML.T0034.002

**Redacted Example Data**
```json
{"gen_ai.conversation.id": "cd71d2fd-8c8e-4fef-9606-8c77dff86de9", "request_count": 5, "first_ts": "2026-08-02T10:41:44.000Z", "last_ts": "2026-08-02T10:41:52.000Z"}
```

Start by reading the existing aws_bedrock_dos_resource_exhaustion_detection.toml hunt and its surrounding apm huntset conventions. Add and validate the supplied ES|QL query for conversation-level bursts, with completion shown by the hunt being represented in the apm ES|QL rules and matching the redacted five-request example.

Written by the indexing model from the issue text.