Adapt definitions of nested subfields to current Fleet implementation

[jsoriano]

Proposed commit message

Adapt definitions of subfields of nested objects so they are actually installed by Fleet. New mappings are otherwise equivalent.

These mappings were correctly defined as expected by the spec, but Fleet was only installing empty nested objects. To workaround that, subfields can be moved to have their own definitions.

Issue in Fleet is fixed in elastic/kibana#191730, but we can apply this workaround for older versions of the stack.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

Install one of these packages, and check that the index templates include the mappings for the fields of the nested objects.

Related issues

• Closes Misleading implementation of mappings of nested object subfields package-spec#784
• Related to [Fleet] Expand subfields of nested objects when generating template kibana#191730
• Originally part of to Fix issues found in integrations after testing with logsdb #10919

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elasticmachine]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 0b5b8d3

cc @jsoriano

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
96.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[efd6]

Checked akamai. Looks good.

[jlind23]

@lalit-satapathy @axw could we please get someone from your team reviewing this?

[ishleenk17]

Reviewed gcp package from infraobs team. Looks good!

[axw]

I only looked at gcp, and mostly rubberstamping because @ishleenk17 already looked. (Logic looks sound though.)

[elasticmachine]

Package akamai - 2.25.1 containing this change is available at https://epr.elastic.co/search?package=akamai

[elasticmachine]

Package falco - 0.1.1 containing this change is available at https://epr.elastic.co/search?package=falco

[elasticmachine]

Package gcp - 2.37.2 containing this change is available at https://epr.elastic.co/search?package=gcp

[elasticmachine]

Package github - 1.29.1 containing this change is available at https://epr.elastic.co/search?package=github

[elasticmachine]

Package google_workspace - 2.25.1 containing this change is available at https://epr.elastic.co/search?package=google_workspace

[elasticmachine]

Package jamf_protect - 2.6.1 containing this change is available at https://epr.elastic.co/search?package=jamf_protect

[elasticmachine]

Package tanium - 1.10.1 containing this change is available at https://epr.elastic.co/search?package=tanium

[elasticmachine]

Package trellix_edr_cloud - 1.2.1 containing this change is available at https://epr.elastic.co/search?package=trellix_edr_cloud