Zeek: Update filebeat configuration guide

The Zeek filebeat configuration guide uses the legacy `log` input type, and not all logs are JSON. Add a filestream input configuration that selectively parses JSON.

- Zeek filestream example:

```yaml
- type: filestream
id: zeek-filestream-json
enabled: true
paths:
- /opt/zeek/spool/zeek/*.log
processors:
- if:
regexp:
message: '^\{'
then:
- decode_json_fields:
fields: ['message']
max_depth: 1
target: 'zeek'
overwrite_keys: false
add_error_key: true
fields_under_root: true
fields:
event_source_product: zeek
```

Open the Zeek filebeat configuration guide and compare its current legacy `log` input with the supplied filestream example. Update the guide to show selective JSON parsing for Zeek logs, and confirm that the documented configuration also covers non-JSON logs.

Written by the indexing model from the issue text.