fix(o365): drop actionResult gate on detection-type gap rules

FileMalwareDetected (RecordType 6) and AlertAdded (RecordType 78) are
system-generated detections that carry no ResultStatus in production.
KryonX's v1.4.1 filter (merged #2661) therefore never resolves
actionResult=success for them, which would silently dead the rules.
The event's presence is the signal, so match on action alone.

Verified against the real filter + production data shapes: all 9 O365
gap rules now fire (MailboxLogin RT2/Succeeded, Set-CASMailbox +
Add-MailboxFolderPermission + Remove-DlpPolicy + Set-MailboxAuditBypass
RT1/True, Disable/UpdateConditionalAccessPolicy RT8/Success,
MailItemsAccessed RT50/Succeeded, FileMalwareDetected RT6 + AlertAdded
RT78 no-ResultStatus).

Author: osmontero

rules/office365/o365_file_malware_detected.yml

@@ -21,7 +21,7 @@ description: |
   3. Remove or quarantine the file
   4. Assess the uploader for compromise
 where: |
-  equals("action", "FileMalwareDetected") && equals("actionResult", "success")
+  equals("action", "FileMalwareDetected")
 groupBy:
   - lastEvent.log.Parameters
   - adversary.user

rules/office365/o365_security_alert_added.yml

@@ -21,7 +21,7 @@ description: |
   3. Triage and remediate per the alert guidance
   4. Document the incident and containment
 where: |
-  equals("action", "AlertAdded") && equals("actionResult", "success")
+  equals("action", "AlertAdded")
 groupBy:
   - lastEvent.log.Parameters
   - adversary.user