Add Audit Buffer IT support

[Deblintrake09]

Related issue
#3963

Description

This Issue aims to add IT support for the new Audit whodata buffer. This is managed by the whodata->queue_size tag that limits the amount of audit events that are received by syscheck. When the queue is full, events are dropped and the files modification are detected through scheduled mode instead of whodata.

Added

• test_audit_buffer_configuration.py module containing 7 cases related to queue_size configuration values
• test_audit_buffer_behavior.py module containing 2 cases related to queue_size basic behavior
• test_audit_buffer_over_time.py module containing 2 cases related to queue_size's behavior in relation to max_eps
• Added new callbacks and functions

NOTE: Originally development was handled and Reviewed in PR #4227.

Testing performed

Tester	Test path	Jenkins	Local	OS	Commit	Notes
@Deblintrake09 (Developer)	test_fim	🟢🟢🟢		Manager	0338b0a	Nothing to highlight
@Deblintrake09 (Developer)	test_fim	🟢🟢🟢		Linux Agent	0338b0a	Nothing to highlight
@Deblintrake09 (Developer)	test_fim	🟢🟢🟢		WindowsAgent	0338b0a	Nothing to highlight
@Deblintrake09 (Developer)	test_fim	🟢🟢🟢	🚫	Solaris & MacOS Agent	0338b0a	Nothing to highlight

[damarisg]

GJ! I remember that we talk about these cases.

I would like to know what happens if:

• Case 1: I configure EPS invalid.
• Case 2: I add the startup_healthcheck (with 'no') and remove the queue_size value.
• Case 3: I add the whodata section without startup_healthcheck section.

Should Core add these cases in the future?

[Deblintrake09]

GJ! I remember that we talk about these cases.

I would like to know what happens if:

* Case 1: I configure EPS invalid.

* Case 2: I add the startup_healthcheck (with 'no') and remove the  queue_size value.

* Case 3: I add the whodata section without startup_healthcheck  section.

Should Core add these cases in the future?

This cases were not considered during testing. From knowledge on the behavior they would be something like:

• Case 1: should show Invalid value for element 'EPS':invalid_value event. Do not know if the value would cause the Agent to fail to start or be ignored and use the default.
• Case 2: removing the queue_size would make the agent work with default size. agent could be flooded and events lost if the auditd internal queue is folded.
• Case 3: the healthcheck will be executed. If the queue_size is too small, the healthcheck will fail.

This cases require further research, and since this tests need to be moved to the wazuh/wazuh repository as part of the migration of ITs, considering if this cases are valid and developing them should be up to Core.