Add uncommon credential type to application [Nobelium]

The query looks for users or service principals that attached an uncommon credential type to application. As part of the Nobelium campaign, the attacker added credentials to already existing applications and used the application permissions to extract users' mails. See How to: Use the portal to create an Microsoft Entra ID application and service principal that can access resources. Reference - https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal