[New Rule] Browser Credential Database Query via Database CLI Utility

### Description

Identifies a command line database client (`sqlite3`, `duckdb`) querying a Chromium-based browser's credential, cookie or autofill database (`Login Data`, `Cookies`, `Cookies.binarycookies`, `Web Data`). `sqlite3` ships with macOS and is Apple-signed, so an adversary can read credentials and session cookies out of a browser profile without introducing an untrusted binary. The rule keys on the database being queried rather than on the trust level of the process querying it.

Checked for overlap before building: `credential_access_suspicious_web_browser_sensitive_file_access.toml` and the wallet rule in #6616 both key on `process.code_signature.trusted`/`exists`, and a trusted `sqlite3` process satisfies neither.

**Validation**: real Elastic Defend telemetry on macOS (Elastic Agent 9.4.0 / Elastic Defend 9.4.1). Two independent real true-positive vectors captured: a direct `sqlite3` query against `Login Data`, and a second against `Cookies` (`SELECT host_key, name FROM cookies`), both via direct exec and via a `bash -c` wrapper, confirming the technique isn't specific to one invocation style or one database file. Real negative control: a genuinely unrelated `sqlite3` invocation against an arbitrary local application database (`/tmp/.../myapp.db`), confirmed excluded via a live `_eql/search` against the actual proposed rule query.

**Update 2026-08-11**: renamed to "Browser Credential Database Query via Database CLI Utility" after review, since the query matches `sqlite3` and `duckdb` and the old name described only one of them. The rule's `false_positives` field was also rewritten: it had described a negative control (an unrelated `sqlite3` invocation that does not match) rather than benign traffic that does match. See #6621.

### Target Ruleset

macos

### Target Rule Type

Event Correlation (EQL)

### Tested ECS Version

8.10.0

### Query

```eql
process where event.action == "exec" and host.os.type == "macos" and process.name in~ ("sqlite3", "duckdb") and
process.command_line like~ ("*Login Data*", "*/Cookies*", "*Cookies.binarycookies*", "*Web Data*")
```

### New fields required in ECS/data sources for this rule?

None. Uses standard `process.*` fields already populated by Elastic Defend on macOS.

### Related issues or PRs

#6621

### References

- https://www.sqlite.org/cli.html
- https://www.microsoft.com/en-us/security/blog/2026/02/02/infostealers-without-borders-macos-python-stealers-and-platform-abuse/
- https://www.sophos.com/en-us/blog/why-amos-matters-the-macos-malware-stealing-data-at-scale

### Redacted Example Data

Real event, true positive (trusted, Apple-signed `sqlite3` querying Chrome's `Cookies` database):

```json
{
"@timestamp": "2026-08-07T07:0x:xx.xxxZ",
"host": { "os": { "type": "macos" } },
"process": {
"name": "sqlite3",
"executable": "/usr/bin/sqlite3",
"args": [
"sqlite3",
"/Users/victim/Library/Application Support/Google/Chrome/Default/Cookies",
"SELECT host_key, name FROM cookies LIMIT 3;"
],
"code_signature": {
"exists": true,
"trusted": true,
"signing_id": "com.apple.sqlite3",
"subject_name": "Software Signing"
}
}
}
```

Real event, negative control (an unrelated database, confirmed not to match via live `_eql/search`):

```json
{
"@timestamp": "2026-08-07T07:03:21.281Z",
"host": { "os": { "type": "macos" } },
"process": {
"name": "sqlite3",
"executable": "/usr/bin/sqlite3",
"args": [
"sqlite3",
"/tmp/s33r_fp_control/myapp.db",
"CREATE TABLE notes (id INTEGER, text TEXT); INSERT INTO notes VALUES (1, 'buy milk'); SELECT * FROM notes;"
],
"code_signature": { "exists": true, "trusted": true, "signing_id": "com.apple.sqlite3" }
}
}
```

Start with the macos ruleset and compare credential_access_suspicious_web_browser_sensitive_file_access.toml and the wallet rule in #6616 for structure and conventions. Add the proposed EQL rule so direct and bash-wrapped sqlite3 or duckdb queries against the listed browser databases match, while the unrelated /tmp database remains excluded.

Written by the indexing model from the issue text.