[Rule Tuning] Potential Password Spraying Attack via SSH

### Link to Rule

https://www.elastic.co/guide/en/security/8.19/potential-password-spraying-attack-via-ssh.html

### Rule Tuning Type

Data Quality - Ensuring integrity and quality of data used by detection rules.

### Description

Missing host.name in Detection Rule "Potential Password Spraying Attack via SSH"

### Problem
The ESQL query is missing `host.name` in both the keep and stats clauses. As a result, the alert does not show which target system the SSH brute-force actually occurred on -> critical for triage and incident response.

### Fix
Add to keep:
`host.name,`

Add to stats:
`Esql.host_hostname_values = values(host.name),`

Impact:
Without this addition, a targeted response (e.g. isolating the affected host) based on the alert is not possible -> priority should be set accordingly high.