Cherry-pick #17155 to 7.x: [Filebeat] Improve AWS cloudtrail field mappings

[leehinman]

Cherry-pick of PR #17155 to 7.x branch. Original message:

• sessionIssuer.type -> aws.cloudtrail.user_identity.session_issuer.type
• sessionIssuer.principalId -> aws.cloudtrail.user_identity.session_issuer.principal_id
• sessionIssuer.userName -> user.name
• sessionIssuer.arn -> aws.cloudtrail.user_identity.session_issuer.arn
• sessionIssuer.accountId -> aws.cloudtrail.user_identity.session_issuer.account_id
• add aws.cloudtrail.console_login.additional_eventdata.mobile_version
• add aws.cloudtrail.console_login.additional_eventdata.login_to
• add aws.cloudtrail.console_login.additional_eventdata.mfa_used
• copy source.address to source.ip if value is an IP address

Closes #16086
Closes #16110

What does this PR do?

• Adds session Issuer information when assumed roles are used
• Adds specific fields when ConsoleLogin events
• sets source.ip

Why is it important?

• Session Issuer is needed for assumed roles
• ConsoleLogin information is needed to easily determine if MFA was used
• source.ip should be set when source .address is an IP address

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
  - [] I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)