[Rule Tuning] Potential Shadow Credentials added to AD Object

### Link to Rule

https://github.com/elastic/detection-rules/blob/main/rules/windows/credential_access_shadow_credentials.toml

### Rule Tuning Type

False Negatives - Enhancing detection of true threats that were previously missed.

### Description

In https://github.com/elastic/detection-rules/pull/2359 we introduced a filter: `winlog.event_data.AttributeValue :B\:828*`, that filter refers to `KEYCREDENTIALLINK_BLOB` length observed in public offensive tooling at the time.

This creates a false negative because 828 is not reliable. LLM explanation:

`In the DN-Binary representation B:::, the count describes the serialized hexadecimal key length. The underlying KEYCREDENTIALLINK_BLOB contains variable entries, including variable-length key material.`

### Impact

Current Impacket generated a 403-byte KeyCredentialLink blob during testing, which we miss. Windows emitted and Elastic ingested Event 5136 with:

```
AttributeValue: B:806::CN=
ObjectClass: computer
OperationType: Value Added
```

### Example Data

```
{
"winlog": {
"record_id": 4801366,
"event_data": {
"SubjectUserSid": "S-1-5-21-2038103339-2155116624-3331879844-1113",
"SubjectUserName": "daenerys.targaryen",
"ObjectDN": "CN=KCLVALC001,OU=DetectionFixtures,DC=essos,DC=local",
"ObjectClass": "computer",
"AttributeLDAPDisplayName": "msDS-KeyCredentialLink",
"AttributeValue": "B:806::CN=KCLVALC001,OU=DetectionFixtures,DC=essos,DC=local",
"OperationType": "Value Added"
}
}
}
```