Split sketchy-mounted-diskimage.sql up

[tstromberg]

This file is like 7 rules in one, with varying levels of criticality. The rules should get split up so it's more obvious to alert readers what is suspicious about the mounted disk image.

99% of the time it's

osquery-defense-kit/detection/initial_access/sketchy-mounted-diskimage.sql

Line 104 in 8a42b80

vol_name LIKE "Install%"

that fires.