Exclude staged Webex upgrade bundles from macOS patch policy

[allenhouchins]

Related issue: Resolves #47440

Summary

Webex's own auto-updater stages fully formed Webex.app bundles under ~/Library/Application Support/Cisco Spark/Webexteams_upgrades_*. Those bundles share the real app's bundle identifier (Cisco-Systems.Spark) at an older version, so osquery's apps table reports them and the FMA patch policy fails on hosts that are actually on the current version.

The install script already deletes those directories after a successful install, but Webex re-stages them between FMA installs/updates, so the cleanup alone isn't enough (the issue was reopened for customer-panoramix on 2026-09-04).

This PR excludes that path in the generated patched query, following the existing docker-desktop precedent for .back bundles:

SELECT 1 WHERE NOT EXISTS (
  SELECT 1 FROM apps
  WHERE bundle_identifier = 'Cisco-Systems.Spark'
    AND path NOT LIKE '%/Library/Application Support/Cisco Spark/Webexteams\_upgrades\_%' ESCAPE '\'
    AND version_compare(bundle_short_version, '46.9.0.35771') < 0
);

Changes

• ee/maintained-apps/ingesters/homebrew/ingester.go: add a webex patched-query override alongside the docker-desktop one.
• ee/maintained-apps/ingesters/homebrew/ingester_test.go: add a webex case asserting the exists/patched queries.
• ee/maintained-apps/outputs/webex/darwin.json: regenerated with go run ./cmd/maintained-apps -slug webex/darwin. Only the patched query changed; version, installer URL and script refs are unchanged, so existing installs pick up the new policy on the next FMA sync.

The remove_stale_upgrade_bundles cleanup in the install script is kept as-is.

Note: _ is a single-character wildcard in LIKE, so the underscores are escaped (ESCAPE '\', the same form Fleet already uses in its host-detail user query). The pattern starts at /Library/Application Support/ rather than /Users/ so home directories outside /Users are covered.

Checklist for submitter

• Input data is properly validated, SELECT * is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.

Testing

• Added/updated automated tests
• QA'd all new/changed functionality manually