Clarify event_action definition

**Please describe what you are requesting**
Clarify event_action documentation for schema

**Describe what change you are proposing**
Add a note for how to handle sources that provide an intended/configured action and the action that was actually taken (e.g., SEPM) and that the actual action should be mapped to event_action.

Locate the schema documentation for event_action and review its current definition. Add guidance covering sources with intended or configured actions alongside the action actually taken, using the actual action as the mapped event_action; confirm the note matches the surrounding documentation.

Written by the indexing model from the issue text.