winlogbeat: provide clearer documentation for migration from endpoint to ingest node processing

[efd6]

In 8.0 Winlogbeat processing moved from the endpoint via javascript to the ingest node. This has caused concern for a number of users.

We should provide clear documentation explaining the new processing architecture and how to migrate a cluster to the new system. A common concern has been how to adapt clusters that use Logstash as a component in a Winlogbeat datastream.

There is documentation for Filebeat explaining how to use ingest pipelines with a Logstash that may be helpful.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)