[Auditbeat] system.process - report Linux capabilities

[andrewkroh]

Describe the enhancement:

Auditbeat system.process reports information about running processes. ECS 8.10 added new process fields that hold the associated Linux capabilities. The system.process module should report the capabilities.

• process.thread.capabilities.effective
• process.thread.capabilities.permitted

go-sysinfo, which this code already uses, supports fetching this data (source), but the returned strings are not in the exact format expected by ECS.

Describe a specific use case for the enhancement or feature:

[norrietaylor]

elastic/go-sysinfo#196

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!