[ti_recordedfuture] Fix the parsing of providers info from evidence fields

[chemamartinez]

Proposed commit message

It fixes an error when parsing EvidenceString fields looking for providers that fill threat.indicator.provider list later in the pipeline. The gsub processor was looking for a specific pattern but didn't discard the whole field when it didn't match.

In order to fix that behavior, it has been modified the regex so that when the regex doesn't match it captures an empty string which is discarded in a subsequent string processor.

The changes related to this fix are applied in the ingest pipeline and the test file test-httpjson.log. Further changes in the pull request are a consequence of unrelated changes that fixed the format of some special characters when running pipeline tests.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• Added pipeline test case to verify the processors handle the provider info properly.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-11-01T17:21:23.404+0000

• Duration: 17 min 56 sec

Test stats 🧪

Test	Results
Failed	0
Passed	11
Skipped	0
Total	11

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[elasticmachine]

🌐 Coverage report

Name	Metrics % (covered/total)	Diff
Packages	100.0% (1/1)	💚
Files	100.0% (2/2)	💚
Classes	100.0% (2/2)	💚
Methods	100.0% (16/16)	💚
Lines	97.619% (205/210)	❕
Conditionals	100.0% (0/0)	💚

[elasticmachine]

Package ti_recordedfuture - 1.18.1 containing this change is available at https://epr.elastic.co/search?package=ti_recordedfuture