Add fields for detection of shadow AI authentication file events

[fearful-symmetry]

Change Summary

This adds two fields, file.ai_agent.email and file.ai_agent.api_key_auth to file events for detection of authentication flows (claude auth, etc) from endpoint. This also adds file modification events for platforms that don't already have them, as we'll need to report modification events for the given authentication stores.

Sample values

            "ai_agent": {
                "email": "test@example.com"
            }

            "ai_agent": {
                "api_key_auth": true
            }

Sample document:

        "file": {
            "path": "/tmp/genai_eaf_31io5qm3/.claude.json",
            "extension": "json",
            "size": 0,
            "name": ".claude.json",
            "ai_agent": {
                "email": "test@example.com"
            }
        },

Release Target

9.6.0

For mapping changes:

• I ran make after making the schema changes, and committed all changes
• If these field(s) are "exception"-able, I made a companion PR to Kibana adding it (see Readme)
• If this is a metadata change, I also updated both transform destination schemas to match

[pzl]

If you pull in the latest main, does this change go away?

I attempted to fix this issue in #779

[fearful-symmetry]

Ah, that did work!