[SIEM integration] Collect authentication related information

As layed out in the [design doc](https://docs.google.com/document/d/1FoQRJkRQ1EhdZDGYnGNhCj4SKiY1quF9jII-XsWVOyA/edit#heading=h.jvh2iid8rap) authentication related APM data should be integrated with SIEM visualizations.

Necessary ECS Information is:
- [x] `@timestamp`: already available
- [ ] `host.name`: https://github.com/elastic/apm-server/issues/2502

- [ ] `host.id`: https://github.com/elastic/apm-server/issues/2608
> Unique host id. As hostname is not always unique, use values that are meaningful in your environment.
> Example: The current usage of beat.name.
> type: keyword

- [ ] `host.os.name`: not collected
> Operating system name, without the version.
> type: keyword
> example: Mac OS X

- [ ] `host.os.version`: not collected
> Operating system version as a raw string.
> type: keyword
> example: 10.14.1

- [ ] `user.name`: already defined and collected, ensure to also collect field on authentication errors

- [ ] `event.category`: should be set to `authentication`
- [ ] `event.outcome`: should be set to `success, failure, unknown`
- [ ] `source.ip`: mapping `http.request.socket.remote_address` (backend) and `client.ip` (RUM) for http events, but not collected and sent for other protocols.
>IP address of the source.
> Can be one or multiple IPv4 or IPv6 addresses.
> type: ip

- [ ] `destination.ip`: ongoing discussions in https://github.com/elastic/apm/issues/115

Above field definitions are copied from [ECS definitions](https://github.com/elastic/ecs/blob/master/docs/field-details.asciidoc)

TODO:
- [ ] investigate how to collect missing information in the agents (@SergeyKleyman) - Opened https://github.com/elastic/apm/issues/136 to gather feedback from the agents teams
- [ ] define scope for which authentication information can be collected (e.g. auth requests over http via username, no token based authentication yet) - Scope defined in https://github.com/elastic/apm/issues/136
- [ ] define Intake API for additional information (apm-server , apm-agent-devs )
- [ ] implement server side processing of agent collected fields to ES fields (apm-server)
- [ ] Define event types eligible for storing authentication related information, most probably ~`span`~ `transaction`. Figure out if agents always create a dedicated event for authentication requests, even when failing and there is an additional error object? Ensure every authentication attempt is only counted once.