[New Rule] Kubernetes execution_user_exec_to_pod (#1979)

* Create execution_user_exec_to_pod.toml

* Update execution_user_exec_to_pod.toml

* Update rules/integrations/kubernetes/execution_user_exec_to_pod.toml

* Update non-ecs-schema.json

* Update execution_user_exec_to_pod.toml

* Update rules/integrations/kubernetes/execution_user_exec_to_pod.toml

Co-authored-by: Terrance DeJesus <[email protected]>

* Update execution_user_exec_to_pod.toml

* Update execution_user_exec_to_pod.toml

* Update execution_user_exec_to_pod.toml

* toml-linted file and add to false positive

toml-linted the file and added to the false positive description

* Create notepad.sct

Added this back into the repo, deleted by mistake.

* added min_stack_version based on integration

min stack version determined by integration support of necessary fields

Co-authored-by: Jonhnathan <[email protected]>
Co-authored-by: Terrance DeJesus <[email protected]>
Co-authored-by: Colson Wilhoit <[email protected]>

(cherry picked from commit 63fda01)

Author: imays11

detection_rules/etc/non-ecs-schema.json

@@ -56,5 +56,9 @@
   },
   "logs-windows.*": {
     "powershell.file.script_block_text": "text"
+  },
+  "logs-kubernetes.*": {
+    "kubernetes.audit.objectRef.resource": "keyword",
+    "kubernetes.audit.objectRef.subresource": "keyword"
   }
 }