ssi_many: dashboard controls query all of logs-* instead of the integration's dataset

Many integration dashboards use Kibana Controls (dropdown filters) that query the broad `logs-*` data view without a dashboard-level `data_stream.dataset` filter. This means the control dropdowns show values from unrelated data sources, and selecting a value can pull in data from other integrations.

Some of these dashboards *do* have per-panel Lens filters for `data_stream.dataset`, but Controls don't inherit panel-level Lens filters -- they rely on the dashboard-level search source. When that search source has an empty `filter` array, the controls are unscoped.

This was originally reported for the Azure Network Watcher NSG dashboard, but the same pattern exists across many dashboards.

## Root cause

The dashboard JSON has:

```json
"kibanaSavedObjectMeta": {
"searchSourceJSON": {
"filter": [],
"query": { "language": "kuery", "query": "" }
}
}
```

The empty `filter` array means Controls query all of `logs-*`. The fix is to add a `data_stream.dataset` filter at the dashboard level, which 401 other dashboards in this repo already do correctly.

## Affected dashboards

51 packages, 172 dashboards total.

| Package | Dashboard |
|---------|-----------|
| admin_by_request_epm | [Logs Admin By Request - EPM] Auditlog |
| amazon_security_lake | [Logs Amazon Security Lake] Application Activity |
| amazon_security_lake | [Logs Amazon Security Lake] DNS Activity |
| amazon_security_lake | [Logs Amazon Security Lake] Discovery |
| amazon_security_lake | [Logs Amazon Security Lake] Email Activity, Email File Activity, Email URL Activity |
| amazon_security_lake | [Logs Amazon Security Lake] Findings |
| amazon_security_lake | [Logs Amazon Security Lake] HTTP, RDP, SMB, DHCP, SSH, FTP, Network File Activity |
| amazon_security_lake | [Logs Amazon Security Lake] Identity and Access Management |
| amazon_security_lake | [Logs Amazon Security Lake] Network Activity |
| amazon_security_lake | [Logs Amazon Security Lake] Overview |
| amazon_security_lake | [Logs Amazon Security Lake] System Activity |
| aws | [Logs AWS] Security Hub CSPM Summary Dashboard |
| aws | [Logs AWS] WAF Log Overview |
| aws | [Metrics AWS] AWS Load Balancer Overview |
| aws_bedrock | [Amazon Bedrock] Guardrails |
| azure_network_watcher_nsg | [Logs Azure Network Watcher NSG] Azure Network Watcher NSG Overview |
| azure_network_watcher_vnet | [Logs Azure Network Watcher VNet] Overview |
| bbot | BBOT Dashboard |
| beyondinsight_password_safe | [Logs Beyondinsight and Password Safe] Overview |
| bitdefender | [BitDefender GravityZone] Configuration State & Statistics |
| bitdefender | [BitDefender GravityZone] Push Notifications |
| blacklens | blacklens.io Alerts |
| cisco_umbrella | [Cisco Umbrella] Audit Logs |
| cisco_umbrella | [Cisco Umbrella] DNS Logs |
| cisco_umbrella | [Cisco Umbrella] Firewall Logs |
| cisco_umbrella | [Cisco Umbrella] Intrusion Logs |
| cisco_umbrella | [Cisco Umbrella] Overview |
| cisco_umbrella | [Cisco Umbrella] Proxy Logs |
| cloudflare | [Cloudflare] Clients |
| cloudflare | [Cloudflare] Content |
| cloudflare | [Cloudflare] Overview |
| cloudflare | [Cloudflare] Performance |
| cloudflare | [Cloudflare] Reliability |
| cloudflare | [Cloudflare] Security (Overview) |
| cloudflare | [Cloudflare] Security (Rate Limiting) |
| cloudflare | [Cloudflare] Security (WAF) |
| cloudflare_logpush | [Logs Cloudflare Logpush] Access Requests |
| cloudflare_logpush | [Logs Cloudflare Logpush] Audit |
| cloudflare_logpush | [Logs Cloudflare Logpush] CASB findings |
| cloudflare_logpush | [Logs Cloudflare Logpush] DNS Firewall |
| cloudflare_logpush | [Logs Cloudflare Logpush] Device Posture |
| cloudflare_logpush | [Logs Cloudflare Logpush] Gateway DNS |
| cloudflare_logpush | [Logs Cloudflare Logpush] Gateway HTTP |
| cloudflare_logpush | [Logs Cloudflare Logpush] Gateway Network |
| cloudflare_logpush | [Logs Cloudflare Logpush] Magic IDS Detections |
| cloudflare_logpush | [Logs Cloudflare Logpush] Network Session Logs |
| cloudflare_logpush | [Logs Cloudflare Logpush] Sinkhole HTTP |
| cloudflare_logpush | [Logs Cloudflare Logpush] Workers Trace Events |
| cloudflare_logpush | [Logs Cloudflare Logpush] Zero Trust overview |
| corelight | [Logs Corelight] AWS VPC Flow |
| corelight | [Logs Corelight] Connections |
| corelight | [Logs Corelight] Corelight Suricata IDS Alert Overview |
| corelight | [Logs Corelight] DNS |
| corelight | [Logs Corelight] Files |
| corelight | [Logs Corelight] HTTP |
| eset_protect | [Logs ESET PROTECT] Detection |
| eset_protect | [Logs ESET PROTECT] Device Task |
| eset_protect | [Logs ESET PROTECT] Event |
| github | [GitHub] Secret Scanning Alerts |
| github | [GitHub] Security Advisories |
| gitlab | [GitLab] Application Overview |
| google_scc | [Logs Google SCC] Asset |
| google_scc | [Logs Google SCC] Audit |
| google_scc | [Logs Google SCC] Finding |
| google_scc | [Logs Google SCC] Overview Dashboard |
| google_scc | [Logs Google SCC] Source |
| imperva_cloud_waf | [Logs Imperva Cloud WAF] Event |
| jamf_pro | [Jamf Pro] Hardware Information |
| jamf_pro | [Jamf Pro] Jamf Pro overview |
| jamf_pro | [Jamf Pro] Locations |
| jamf_pro | [Jamf Pro] Real time |
| jamf_pro | [Jamf Pro] Remote Status |
| jamf_protect | Jamf Protect - Alerts |
| jamf_protect | Jamf Protect - Endpoint Telemetry |
| jumpcloud | [JumpCloud] Directory Insights Summary |
| keeper_security_siem_integration | Keeper SIEM Integration Dashboard |
| m365_defender | [Logs Microsoft Defender XDR] Alert (x2) |
| m365_defender | [Logs Microsoft Defender XDR] App & Identity |
| m365_defender | [Logs Microsoft Defender XDR] Device |
| m365_defender | [Logs Microsoft Defender XDR] Email |
| m365_defender | [Logs Microsoft Defender XDR] Incident |
| microsoft_defender_endpoint | [Logs Microsoft Defender Endpoint] Machine Action Overview |
| microsoft_defender_endpoint | [Microsoft Defender for Endpoint] Overview |
| nextron_thor | [Nextron Thor] Overview |
| o365 | [Logs o365] Audit Dashboard |
| o365 | [Logs o365] User |
| prisma_cloud | [Logs Prisma Cloud] Alert |
| prisma_cloud | [Logs Prisma Cloud] Audit |
| prisma_cloud | [Logs Prisma Cloud] Host |
| prisma_cloud | [Logs Prisma Cloud] Host Profile |
| prisma_cloud | [Logs Prisma Cloud] Incident Audit |
| prisma_cloud | [Logs Prisma Cloud] Misconfiguration |
| prisma_cloud | [Logs Prisma Cloud] Vulnerability |
| proofpoint_essentials | [Logs Proofpoint Essentials] Clicks Overview |
| proofpoint_essentials | [Logs Proofpoint Essentials] Messages Overview |
| qualys_was | [Qualys Web Application Scanning] Detections Summary |
| sailpoint_identity_sc | [Events Sailpoint identity security cloud] Overview |
| sentinel_one | [Logs SentinelOne] Activities |
| sentinel_one | [Logs SentinelOne] Agents |
| sentinel_one | [Logs SentinelOne] Alerts |
| sentinel_one | [Logs SentinelOne] Application |
| sentinel_one | [Logs SentinelOne] Application Risk |
| sentinel_one | [Logs SentinelOne] Groups |
| sentinel_one | [Logs SentinelOne] Threat Events |
| sentinel_one | [Logs SentinelOne] Threats |
| sentinel_one | [Logs SentinelOne] Unified Alerts |
| spycloud | [Logs SpyCloud] Breach Catalog |
| spycloud | [Logs SpyCloud] Breach Record |
| spycloud | [Logs SpyCloud] Compass |
| symantec_endpoint_security | [Logs SES] Incident |
| symantec_endpoint_security | [Logs SES] Overview |
| symantec_endpoint_security | [Logs SES] Security Event |
| tenable_ot_security | [Tenable OT Security] Events |
| tenable_ot_security | [Tenable OT Security] Overview |
| threat_map | Threat Map |
| ti_abusech | [Logs abuse.ch] Domains and IP Addresses |
| ti_abusech | [Logs abuse.ch] Files |
| ti_abusech | [Logs abuse.ch] Overview |
| ti_abusech | [Logs abuse.ch] Software and X-509 Certificates |
| ti_abusech | [Logs abuse.ch] URLs |
| ti_domaintools | [Logs DomainTools Feeds] Overview |
| ti_eset | [Logs ESET] Domains, URL, IP |
| ti_eset | [Logs ESET] Files |
| ti_eset | [Logs ESET] Other indicators |
| ti_mandiant_advantage | Mandiant Threat Intelligence Overview |
| ti_opencti | [Logs OpenCTI] Ingestion |
| ti_opencti | [Logs OpenCTI] Overview |
| ti_opencti | [Logs OpenCTI] Tags & Quality |
| ti_rapid7_threat_command | [Logs Rapid7 Threat Command] Alert Overview |
| ti_recordedfuture | [Logs RecordedFuture] Files |
| ti_recordedfuture | [Logs RecordedFuture] Overview |
| ti_recordedfuture | [Logs RecordedFuture] URLs |
| ti_util | Threat Intelligence Overview |
| tines | [Tines] Audit Logs |
| tines | [Tines] Time Saved |
| trend_micro_vision_one | [Logs Trend Micro Vision One] Network Activity |
| trend_micro_vision_one | [Trend Micro Vision One] Endpoint Activity |
| tychon | [TYCHON] Endpoint Browser - Benchmark Results |
| tychon | [TYCHON] Endpoint Browser - Drives and Disks |
| tychon | [TYCHON] Endpoint Browser - Endpoint Protection |
| tychon | [TYCHON] Endpoint Browser - Hardware Inventory |
| tychon | [TYCHON] Endpoint Browser - Host Information |
| tychon | [TYCHON] Endpoint Browser - Network Cards |
| tychon | [TYCHON] Endpoint Browser - Services and Ports |
| tychon | [TYCHON] Endpoint Browser - Software Inventory |
| tychon | [TYCHON] Endpoint Browser - Vulnerabilities |
| tychon | [TYCHON] Host CPUs |
| tychon | [TYCHON] STIG Report Dashboard |

## Notes

- Some dashboards cover multiple data streams (e.g. `amazon_security_lake`, `cloudflare`). The correct `data_stream.dataset` value(s) for the dashboard-level filter need to be determined per dashboard -- some may need a multi-value filter or a prefix match.
- Dashboards for metrics data streams (e.g. the AWS Load Balancer dashboard) should use `metrics-*` rather than `logs-*`, and the dataset filter logic may differ. Worth checking individually.
- The `threat_map` and `ti_util` dashboards intentionally span multiple datasets (they already have `data_stream.dataset` as a *control field*). These may be working as designed and could be excluded from the fix.