Mandiant threat intel source doesn't get split correctly when using JSON zeek log format

[mmguero]

I found this in testing the release of v24.11.0, but I decided it was small enough to not warrant pushing the release as it's being waited on by some partners for some other things.

Here's the repro:

1. set ZEEK_JSON to true in ./config/zeek.env
2. configure Zeek intelligence to pull from a Mandiant feed
3. generate traffic that would generate intel.log entries
4. look at the sources field and you'll see something like Mandiant|https://whatever...

I think the issue is the split on the | in the intel.log parsing code probably doesn't work on an array, which is what sources already is. We need to rewrite it in ruby probably, to split the individual entries whether they're in an array already or not.