Fix WILDCARD field name in malware_user_agents lookup

[munzzyy]

Details

malware_user_agents.yml sets match_type: WILDCARD(malware_user_agents) but the CSV column is malware_user_agent (singular). Wildcard mode lands on a field that does not exist. The real column falls back to exact matching. 11 of the 89 rows are patterns like arkei/* and SSLoad/*. No real user agent literally contains an asterisk. HTTP Malware User Agent silently misses all of them. Exact rows still match and hide the problem.

Reproduced on Splunk 9.3.14 with the app built from develop. Before:

| makeresults | eval http_user_agent="arkei/1.2"
| lookup malware_user_agents malware_user_agent AS http_user_agent OUTPUT malware

2026-08-02 10:14:29.000 CDT arkei/1.2

After the one line fix and a rebuild:

2026-08-02 10:17:01.000 CDT arkei/1.2       Arkei Stealer

The exact row JustKidding returns Arbitrium-RAT before and after. Bumped the lookup version and date since the generated transforms change.

Five other lookups also name a wrong match_type field. Their match columns hold no wildcard patterns today so nothing breaks. Want those swept in this PR too or left alone? Thanks!

Checklist

• Validate name matches <platform>_<mitre att&ck technique>_<short description> nomenclature - N/A, no detection added or renamed
• CI/CD jobs passed ✔️
• Validated SPL logic. - N/A, no SPL changed
• Validated tags, description, and how to implement.
• Verified references match analytic. - N/A, no analytic changed
• Confirm updates to lookups are handled properly.