Improved Linux local account discovery detection and false positives

[Aadith1422]

What:

• Improved Linux local system account discovery rule

Why:

• Enhances detection coverage for common account enumeration techniques
• Improves false positive documentation for SOC analysts

How:

• Added detection for getent, awk, and cut usage against /etc/passwd
• Updated rule status to experimental

Testing:

• Reviewed logic against Atomic Red Team T1087.001 examples