add strings.decode_hex to multiple rules

[zoomequipd]

Description

Add detection for hex encoded recipient email address in multiple rules. This technique has not been observed in all file formats.

Associated samples

N/A

Associated hunts

• attachment_ics_qr_rcpt_email Net New
• attachment_pdf_qr_rcpt_email_cred Net new
• attachment_pdf_recip_email_in_link net new
• link_qr_code_suspicious_language_fts net new
• attachment_qr_code_suspicious_components net new
• attachment_adobe_image_lure_qr_code net new
• link_credential_phishing_intent_and_other_indicators
• attachment_qr_link_encoded_recipient net new - renamed and updated desc
• link_fragment_all_in_the_family - net new (0 expected) - regression check (0 expected)

[github-actions]

Test Rules Sync - Excluded

This PR contains rules that use ml.link_analysis, which is not supported in the test-rules environment.

The hunting-required label has been applied. These rules will need to be tested through alternative methods.

[zoomequipd]

marking review needed, i think i got them all