ssi_all: cel integrations do not properly guard against null

The data streams below all have the pattern `has(x.f) && size(x.f) != 0` or similar. This is used to guard against empty arrays. However, it does not guard against `null` in place of an empty array, and idiom that is reasonably common (an example of this caused a runtime failure in the `aws.config` data stream ([ref](https://github.com/elastic/integrations/pull/18787)).

The pattern is not always unsafe; it may be that the program sets the field to an array and so there is static proof that the test is always successful, or the API might document that the value is always an array. It might though just be simpler to always apply the fix (`has(x.f) && x.f != null && size(x.f) != 0`).

| Integration | Data stream | File | Lines |
|---|---|---|---|
| abnormal_security | ai_security_mailbox | cel.yml.hbs | 28 |
| abnormal_security | ai_security_mailbox_not_analyzed | cel.yml.hbs | 51 |
| abnormal_security | audit | cel.yml.hbs | 60, 61 |
| abnormal_security | case | cel.yml.hbs | 27 |
| abnormal_security | threat | cel.yml.hbs | 29, 77 |
| abnormal_security | vendor_case | cel.yml.hbs | 28 |
| airlock_digital | agent | cel.yml.hbs | 44, 88 |
| airlock_digital | execution_histories | cel.yml.hbs | 58 |
| airlock_digital | server_activities | cel.yml.hbs | 54 |
| armis | alert | cel.yml.hbs | 92 |
| armis | device | cel.yml.hbs | 93 |
| armis | vulnerability | cel.yml.hbs | 73, 92, 140 |
| auth0 | logs | cel.yml.hbs | 117 |
| bitsight | vulnerability | cel.yml.hbs | 96, 129, 189, 250 |
| cisco_duo | auth | cel.yml.hbs | 97 |
| cisco_duo | telephony_v2 | cel.yml.hbs | 99, 112 |
| cisco_duo | trust_monitor | cel.yml.hbs | 95, 108 |
| claroty_xdome | alert | cel.yml.hbs | 26, 96, 128, 302 |
| claroty_xdome | event | cel.yml.hbs | 96 |
| claroty_xdome | vulnerability | cel.yml.hbs | 26, 109, 141, 317 |
| cloudflare | audit | cel.yml.hbs | (matched) |
| dataminr_pulse | alerts | stream.yml.hbs | 140 |
| github | security_advisories | cel.yml.hbs | 65, 78 |
| imperva_cloud_waf | event | cel.yml.hbs | 26 |
| m365_defender | vulnerability | cel.yml.hbs | 123 |
| microsoft_defender_endpoint | vulnerability | cel.yml.hbs | 123 |
| microsoft_sentinel | alert | cel.yml.hbs | 31, 83 |
| microsoft_sentinel | incident | cel.yml.hbs | 50 |
| mimecast | archive_search_logs | cel.yml.hbs | 93 |
| mimecast | audit_events | cel.yml.hbs | 86 |
| mimecast | dlp_logs | cel.yml.hbs | 93 |
| mimecast | message_release_logs | cel.yml.hbs | (matched) |
| mimecast | ttp_ap_logs | cel.yml.hbs | 93 |
| mimecast | ttp_ip_logs | cel.yml.hbs | 93 |
| mimecast | ttp_url_logs | cel.yml.hbs | 93 |
| nozomi_networks | alert | cel.yml.hbs | 52 |
| nozomi_networks | asset | cel.yml.hbs | 52 |
| nozomi_networks | audit | cel.yml.hbs | 52 |
| nozomi_networks | health | cel.yml.hbs | 52 |
| nozomi_networks | node | cel.yml.hbs | 52 |
| nozomi_networks | node_cve | cel.yml.hbs | 52 |
| nozomi_networks | session | cel.yml.hbs | 52 |
| nozomi_networks | variable | cel.yml.hbs | 52 |
| proofpoint_itm | report | cel.yml.hbs | 40, 43 |
| qualys_vmdr | asset_host_detection | input.yml.hbs | 36, 62, 180 |
| sentinel_one | application | cel.yml.hbs | 28, 79 |
| sentinel_one | threat_event | cel.yml.hbs | 28, 79 |
| servicenow | event | cel.yml.hbs | (matched) |
| snyk | audit_logs | cel.yml.hbs | (matched) |
| sublime_security | message_event | cel.yml.hbs | 27, 57 |
| sysdig | cspm | cel.yml.hbs | 38, 50 |
| tenable_io | scan | cel.yml.hbs | 28, 61 |
| ti_flashpoint | alert | cel.yml.hbs | 48, 58 |
| ti_flashpoint | indicator | cel.yml.hbs | (matched) |
| ti_flashpoint | vulnerability | cel.yml.hbs | 47, 68, 85 |
| ti_google_threat_intelligence | cryptominer | cel.yml.hbs | 45 |
| ti_google_threat_intelligence | first_stage_delivery_vectors | cel.yml.hbs | 45 |
| ti_google_threat_intelligence | infostealer | cel.yml.hbs | 45 |
| ti_google_threat_intelligence | ioc_stream | cel.yml.hbs | 48 |
| ti_google_threat_intelligence | iot | cel.yml.hbs | 45 |
| ti_google_threat_intelligence | linux | cel.yml.hbs | 45 |
| ti_google_threat_intelligence | malicious_network_infrastructure | cel.yml.hbs | 45 |
| ti_google_threat_intelligence | malware | cel.yml.hbs | 45 |
| ti_google_threat_intelligence | mobile | cel.yml.hbs | 45 |
| ti_google_threat_intelligence | osx | cel.yml.hbs | 45 |
| ti_google_threat_intelligence | phishing | cel.yml.hbs | 45 |
| ti_google_threat_intelligence | ransomware | cel.yml.hbs | 45 |
| ti_google_threat_intelligence | threat_actor | cel.yml.hbs | 45 |
| ti_google_threat_intelligence | trending | cel.yml.hbs | 45 |
| ti_google_threat_intelligence | vulnerability_weaponization | cel.yml.hbs | 45 |
| ti_greynoise | ip | cel.yml.hbs | 43 |
| ti_opencti | indicator | cel.yml.hbs | (matched) |
| ti_recordedfuture | playbook_alert | cel.yml.hbs | 30, 108 |
| trend_micro_vision_one | endpoint_activity | cel.yml.hbs | 60, 75 |
| trend_micro_vision_one | network_activity | cel.yml.hbs | 60, 75 |
| vectra_rux | audit | cel.yml.hbs | 47 |
| vectra_rux | detection_event | cel.yml.hbs | 47 |
| vectra_rux | entity_event | cel.yml.hbs | 49, 53 |