[Winlogbeat] Move addition of event.ingested field from the modules' pipelines to the winlogbeat-routing pipeline

[herrBez]

Describe the enhancement:

Move addition of ecs field event.ingested from the modules' pipelines (sysmon, security, powershell and powershell_operational) pipelines to the winlogbeat-{{agent.version}}-routing pipeline.

Describe a specific use case for the enhancement or feature:

• As an Elasticsearch user I want all indices to be ECS-compliant
• As an Elasticsearch user I want to see the latency between the event on the original machine (@timestamp), generation of the event in winlogbeat (event.created) and the arrival to elasticsearch (event.ingested)
• As a Kibana user I may want to create index-patterns based on event.ingested instead of @timestamp

References

See #29435 for additional details

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[andrewkroh]

That sounds like a good idea so that it can enrich events with event.ingested that are not handled by specific pipelines.

[andrewkroh]

This depends on #30406. We need the integration tests in place first. Currently the pipelines are clones from Fleet and are tested there. But if we are going to be making modifications then we need those tests in place.