Use query XML for windows events logs

[jefchien]

Description of the issue

Follow up to #2193. The original PR used OTTL based filtering for event IDs and levels, which didn't work if the format of the event log was XML.

Description of changes

Dependent on the cherry-pick in amazon-contributing/opentelemetry-collector-contrib#598 that adds query XML support to the receiver. This leverages that functionality to be more in-line with the logs/logs_collected/windows_events.

License

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Tests

Built and tested on Windows instance using eventcreate to generate events. The filtering works and now works when sending the logs in XML.

{
    "resource": {
        "attributes": {
            "cloud.resource_id": "arn:aws:ec2:us-east-1:<accountID>:instance/<instanceID>",
            "service.name": "unknown_service",
            "deployment.environment.name": "aws_ec2:default",
            "cloud.provider": "aws",
            "cloud.platform": "aws_ec2",
            "cloud.region": "us-east-1",
            "cloud.account.id": "<accountID>",
            "cloud.availability_zone": "us-east-1b",
            "host.id": "<instanceID>",
            "host.image.id": "ami-0e3c2921641a4a215",
            "host.type": "t3.large",
            "host.name": "<hostname>"
        },
        "schemaUrl": "https://opentelemetry.io/schemas/1.6.1"
    },
    "scope": {
        "attributes": {
            "cloudwatch.source": "cloudwatch-agent",
            "cloudwatch.solution": "otel-windows-events"
        }
    },
    "timeUnixNano": 1784047348750830600,
    "observedTimeUnixNano": 1784047349298379600,
    "severityNumber": 17,
    "severityText": "ERROR",
    "body": "<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='CWAgentTest'/><EventID Qualifiers='0'>777</EventID><Version>0</Version><Level>2</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2026-07-14T16:42:28.7508306Z'/><EventRecordID>24923</EventRecordID><Correlation/><Execution ProcessID='4916' ThreadID='0'/><Channel>Application</Channel><Computer>EC2AMAZ-OO6QGF9</Computer><Security UserID='S-1-5-18'/></System><EventData><Data>XML test: ERROR id=777 should appear in error-only only (not warning-and-id-777)</Data></EventData><RenderingInfo Culture='en-US'><Message>XML test: ERROR id=777 should appear in error-only only (not warning-and-id-777)</Message><Level>Error</Level><Task>None</Task><Opcode>Info</Opcode><Keywords><Keyword>Classic</Keyword></Keywords></RenderingInfo></Event>",
    "traceId": "",
    "spanId": ""
}

Requirements

Before commiting your code, please do the following steps.

1. Run make fmt and make fmt-sh
2. Run make lint

---

Integration Tests

To run integration tests against this PR, add the ready for testing label.

[sky333999]

nit: might wanna sort the levels and then hash