Spellcheck the query packs as well (#5638)

Now that these are in the repo we need to check them here

Signed-off-by: Tim Smith <tsmith84@gmail.com>

Author: tas50

.github/actions/spelling/expect.txt

@@ -1,4 +1,5 @@
 ACCOUNTADMIN
+Adddays
 atlassian
 auditlog
 Auths
@@ -10,12 +11,14 @@ bigquery
 bytematchstatement
 cavium
 cdn
+cea
 certificatechains
 cloudflare
 Clusterwide
 cmek
 cpe
 cryptokey
+CUSTOMERID
 customresources
 datapath
 DATAUSER
@@ -32,6 +35,7 @@ gcfs
 gcs
 geomatchstatement
 gistfile
+googleworkplace
 gpu
 gvnic
 headerorder
@@ -56,19 +60,20 @@ mcr
 messagestoragepolicy
 mfs
 mgroup
-Mpim
 mkey
+mpim
 natgateway
 networkinterface
 nmap
 nodegroup
+nodekey
 nodepool
 notebookinstancedetails
 nsrecord
 nullgroup
 nullstring
-nodekey
 opcplc
+openssh
 openssl
 orstatement
 PAYG
@@ -84,6 +89,7 @@ resourcegroup
 rtsp
 rulegroup
 rulegroupreferencestatement
+saas
 Sas
 scim
 scm
@@ -98,18 +104,19 @@ spo
 sqli
 sqlimatchstatement
 sqlserver
+tailscale
 targetgroup
 tde
 testutils
 timestream
 toplevel
 tpu
-tailscale
 usb
 vdcs
 virtualmachine
 Vtpm
 vulnerabilityassessmentsettings
 vulnmgmt
 wil
+xoxp
 xssmatchstatement

.github/actions/spelling/line_forbidden.patterns

@@ -77,7 +77,7 @@
 \bDevops\b
 
 # s.b. SaaS
-\b[Ss]aas\b
+# \b[Ss]aas\b # false positives in query packs
 
 # s.b. Docker Hub
 \bDocker[Hh]ub\b

.github/actions/spelling/only.txt

@@ -1,2 +1,3 @@
 \.md$
 \.lr$
+\.mql.yaml$