filebeat/module/auditd: implement support for ENRICHED format logs

As described in https://github.com/elastic/integrations/issues/5343 for the auditd fleet integration auditd can have an ENRICHED format. This format uses the escape character (`^[`) to separate the standard structured data from the enriched fields resulting in failure of the original `grok` processor to construct fields correctly. This was fixed for the fleet package in elastic/integrations#8716, but the change was not reflected into the beats module.

Replay the equivalent of that PR for the filebeat auditd module [here](https://github.com/elastic/beats/blob/0dc012db7247246a1439311686e7a7cb8515efdb/filebeat/module/auditd/log/ingest/pipeline.yml#L7-L22).

Start with filebeat/module/auditd/log/ingest/pipeline.yml, especially lines 7-22, and compare the auditd fleet integration change in elastic/integrations#8716. Replay that change for the Beats module and verify that ENRICHED auditd logs no longer cause the grok processor to construct fields incorrectly.

Written by the indexing model from the issue text.