FIX: Hunt query for HTTP EXE downloads should work for both Zeek and Suricata

[dougburks]

In Hunt, we have a query for HTTP EXE downloads:

event.dataset:http AND file.resp_mime_types:dosexec | groupby http.virtual_host

This query works if you're running Zeek for metadata, but it doesn't work if you're running Suricata for metadata. We can fix this as follows:

event.dataset:http AND (file.resp_mime_types:dosexec OR file.resp_mime_types:executable) | groupby http.virtual_host