fix: update metadata and prefix test

rules/cloud/github/github_self_hosted_runner_changes_detected.yml

@@ -11,13 +11,20 @@ references:
     - https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners#about-self-hosted-runners
     - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#search-based-on-operation
 tags:
-    - attack.t1526
     - attack.impact
+    - attack.discovery
+    - attack.collection
+    - attack.defense_evasion
+    - attack.persistence
+    - attack.privilege_escalation
+    - attack.initial_access
+    - attack.t1526
     - attack.t1213.003
     - attack.t1078.004
 logsource:
     product: github
     service: audit
+    definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming'
 detection:
     selection:
         action: