report validation was updated so that it identifies "query"
ioc types and ensures that a report either has just one
query value and nothing else, or other IOCs and no query values.

Also, if "query" IOC type is found, ensure that index_type is
either "events" or "modules".