EQL: Add explicit 'any where ...' handling (elastic#52526)

Author: rw-access

x-pack/plugin/eql/src/main/antlr/EqlBase.g4

@@ -63,7 +63,7 @@ subquery
     ;
 
 eventQuery
-    : event=identifier WHERE expression
+    : (ANY | event=identifier) WHERE expression
     ;
 
 expression
@@ -143,6 +143,7 @@ string
     ;
 
 AND: 'and';
+ANY: 'any';
 BY: 'by';
 FALSE: 'false';
 FORK: 'fork';