Clarify event.kind definitions re: vulnerabilities

[MikePaquette]

During a review of the ECS categorization fields, it was noticed that the examples given for event.kind:"metric" were actually a better fit for event.kind:"state"

This PR clarifies both definitions.

No ECS fields or values are changed with this PR.

Thanks @dainperkins for noticing this.

[webmat]

Thanks for this improvement @MikePaquette

A few requests:

• Please add a changelog entry :-)
• Remove additional mention of vulnerability reports as metrics (see comment)
• Discussion: could we find better examples for event.kind:state? (see comment)
• Discussion: I think we should address head on the fact that there can be state transition events (cluster went from green to red) and state info events (every minute: cluster is still green).
  • I think there was discussion that state transitions should be event.kind:event and state info should be event.kind:state.
  • Although I'm not sure I like the approach in the point above. I think all state events should be in event.kind:state, and whether it's a transition or an informational update should be determined via another field.

[webmat]

LGTM

[dainperkins]

just a couple of potential areas for clarification, might just be me being overly esoteric