github.audit: Update event.kind to "alert" for code_scanning and secret_scanning actions.

[kcreddy]

Proposed commit message

github.audit: Update "event.kind" to "alert" for "code_scanning" and "secret_scanning" actions.

Update "event.kind" to "alert" for "code_scanning.alert_created" 
and "secret_scanning_alert.create" actions as these indicate an 
alerts from Code Scanning and Secret Scanning features.

Add new fields to the audit data stream:
- multi_repo
- number
- publicly_leaked
- secret_type
- secret_type_display_name

Test sample is taken from redacted live data.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

Related issues

Screenshots

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 1705c0d

History

• 💔 Build #35870 failed 7cf875a

cc @kcreddy

[ShourieG]

LGTM

[elastic-vault-github-plugin-prod]

Package github - 2.20.0 containing this change is available at https://epr.elastic.co/package/github/2.20.0/