teleport: fix field mappings for allowed_resource_ids and addr

[efd6]

Proposed commit message

teleport: fix field mappings for allowed_resource_ids and addr

Change certificate.identity.allowed_resource_ids from keyword to
flattened. Teleport's proto defines this as repeated ResourceID, an
array of objects with cluster, kind, name, and sub_resource fields.
The keyword mapping rejected these with document_parsing_exception.

The allowed_resource_ids field is defined as repeated ResourceID in
the Identity message (events.proto L3283–3286):

    repeated ResourceID AllowedResourceIDs = 22 [
        (gogoproto.jsontag) = "allowed_resource_ids,omitempty",
        (gogoproto.nullable) = false
    ];

ResourceID is a message with four string fields (types.proto L2470–2482):

    message ResourceID {
        string ClusterName = 1 [(gogoproto.jsontag) = "cluster"];
        string Kind = 2 [(gogoproto.jsontag) = "kind"];
        string Name = 3 [(gogoproto.jsontag) = "name"];
        string SubResourceName = 4 [(gogoproto.jsontag) = "sub_resource,omitempty"];
    }

This serialises as a JSON array of objects, which keyword cannot index.

Add a field definition for teleport.audit.addr, which carries the
target address in port forwarding events (event code T3003I). The
pipeline already handled the dotted-key addr.local/addr.remote form
from ConnectionMetadata but had no mapping for the plain string form
from PortForward.

Fix a copy-paste error in the setup documentation that referenced
Symantec Endpoint Security instead of Teleport.

Test events were constructed from the Teleport events proto definition
(api/proto/teleport/legacy/types/events/events.proto), not captured
from a live system.

Refs:
- https://github.com/gravitational/teleport/blob/473969a700c3c4f981e956fae8a0d14c65c88abe/api/proto/teleport/legacy/types/events/events.proto#L3283-L3286
- https://github.com/gravitational/teleport/blob/47028caeaba99d33362a72edbb569749ff6b2f0d/api/proto/teleport/legacy/types/types.proto#L2470-L2483

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

Related issues

Screenshots

[github-actions]

✅ Vale Linting Results

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: a9c3f22

History

• 💔 Build #42368 failed a5e9943

cc @efd6

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[ShourieG]

LGTM

[elastic-vault-github-plugin-prod]

Package teleport - 1.6.1 containing this change is available at https://epr.elastic.co/package/teleport/1.6.1/