[Security Solution] Expand DF Query in the high_count_network_denies ML job

[randomuserid]

Describe the bug:

Network ACL deny events are populated differently by different modules so we need to OR another field test in the DF query.

Kibana/Elasticsearch Stack version:

7.13

Functional Area (e.g. Endpoint management, timelines, resolver, etc.):

Security ML Jobs

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)