Fix broken regex alternation in detections

[srkyn]

Summary

• Restores regex alternation that was split across SPL pipeline lines
• Updates affected analytic metadata versions and modification dates
• Covers the six detections called out in [BUG] Broken REGEX for several detections #4077

Validation

• YAML parsed successfully for all touched detections
• Regex sanity check compiled match() patterns from the touched searches
• git diff --check passed

Fixes #4077

[srkyn]

Rechecked the current failed CI run. The detection YAML/build checks are passing, and the two failing jobs appear blocked before exercising this regex change because the credential variables are empty in the run:

• appinspect: APPINSPECTUSERNAME / APPINSPECTPASSWORD are empty, then Splunk API login returns 400 Client Error
• unit-testing: contentctl-ng install exits with "Splunkbase credentials not provided in environment variables" before producing test_results/summary.yml

I will leave the branch scoped to the regex alternation fix unless you want a repo-side change.