APP-14817 - Fix trellix queries

[jzolo22]

The query validator didn't pick up on this but it looks like DATE in capitals isn't valid - got this error when trying to import the rule pack:

"Error parsing query. Unexpected token \"DATE\" at line 1 column 81. \n> 1 | FIND (trellix_apiKey|trellix_mobileApiKey) WITH expiredOn = true OR startDate > DATE.now - 365 days\n    |                                                                                 ^^^^"

QA Checklist

Alerts Rule Packs

• IF THIS CONTENT NEEDS TO BE RELEASED - is the package version in the package.json bumped?
• Does a related alert already exist, and should it be tweaked or added to instead?
• Test each query to make sure it works
• Look for hardcoded variables/parameter values in the query
• Consider Severity for Alerts
• Spellcheck
• Use all caps for J1QL keywords and relationship classes
• Upload the alerts rule pack JSON into JupiterOne to validate

[jzolo22]

If you toggle hide whitespace on it's a lot easier to see that the changes are just DATE to date