Cherry-pick #15217 to 7.x: Audit/Computer/Distribution Groups Management Events - ECS related.user field mapping

[andrewkroh]

Cherry-pick of PR #15217 to 7.x branch. Original message:

Added Audit and Log Management related events, Computer Object Management Events, Distribution Groups Events - Change in user.name for user management events and related.user mapping

Event	Description
1100	The event logging service has shut down.
1102	The audit log was cleared.
1104	The security log is now full.
1105	Event log automatic backup.
1108	The event logging service encountered an error while processing an incoming event published from %1
4719	System audit policy was changed.
4741	A computer account was created.
4742	A computer account was changed.
4743	A computer account was deleted.
4744	A security-disabled local group was created.
4745	A security-disabled local group was changed.
4746	A member was added to a security-disabled local group.
4747	A member was removed from a security-disabled local group.
4748	A security-disabled local group was deleted.
4749	A security-disabled global group was created.
4750	A security-disabled global group was changed.
4751	A member was added to a security-disabled global group.
4752	A member was removed from a security-disabled global group.
4753	A security-disabled global group was deleted.
4759	A security-disabled universal group was created.
4760	A security-disabled universal group was changed.
4761	A member was added to a security-disabled universal group.
4762	A member was removed from a security-disabled universal group.
4763	A security-disabled global group was deleted.

New Events
Due to that Windows events are the source of information for Winlogbeat the events 1100,1102,1104,1105,1108 and 4719 has been added in order to monitor changes in the audit policy configuration, log deletion and other failures in the log subsystem.
For event 4719 a human readable description was added in order to know which setting was modified (winlog.event_data.SubCategory) and to which value (winlog.event_data.AuditPolicyChangesDescription)

Distribution Groups (Security-Disabled) Management Events were added. Those events are processed in the same way and with the same function that Security Groups (#14299). In order to add information about the nature of the group being managed the type (Security-Disabled/Security-Enabled) and scope (Local,Global,Universal) where added as winlog.group.type and winlog.group.scope

ComputerObject Management events were added

Changes to ECS mappings

In elastic/ecs#678 and elastic/ecs#589 we have been discussing how n-ary relationship between users in an event should be named and mapping into ECS.
In #13530 winlog.event_data.TargetUserName has been mapped to user.name but from the reasons exposed in elastic/ecs#678 and elastic/ecs#589 the mapping winlog.event_data.SubjectUserName -> user.name is more appropriate. This mapping was changed.

Also, with the adding of related fields in ECS 1.3 and specifically the related.user field (elastic/ecs#694) all the user names appearing in one event were mapped to the related user events.
Every time a SubjectUserName or TargetUserName is copied also is added to the related.user field, as well as other users appearing in the event.

Event test data were added for all events with the exception of event 1108 which I was not able to reproduce

[leehinman]

I just noticed that original PR didn't have a Changelog entry, so the backport doesn't either. We should probably add one.