[Packetbeat] Add support for ignoring interfaces

**Describe the enhancement:**
Currently when setting the `packetbeat` sniffer the interface field is either an interface name or `any` for all interfaces. If you have N number of interfaces your only option is to use `any`.

- Add support for filtering interfaces you don't want to sniff on.

**Describe a specific use case for the enhancement or feature:**

The enhancement would be to add support for specifying a list of interfaces that should be ignore by the sniffer. This would allow packetbeat to focus on interfaces the user cares about.

`packetbeat.interfaces.ignore: [lo, eth0, veth, docker0]`

**Current solution**

Currently the only way to accomplish this is by adding processors and drop_events, at this point the packetbeat process has sniffed those packets only to be dropped this takes cycles from actual interfaces the user cares about.

The docs say the events have the `interface.name` field, but I don't have that ECS for some reason. Not sure if it's related to my output being `logstash` instead of `elasticsearch`.

Start by tracing Packetbeat's sniffer configuration and the existing handling of the `interface` value, then inspect how processors and `drop_events` currently filter packets. Done means users can configure `packetbeat.interfaces.ignore` with interface names and those interfaces are excluded from sniffing rather than filtered after capture.

Written by the indexing model from the issue text.