[docs-patrol] Document PANW exported fields for ipsec_tunnel.state and observer.hostname

Recent code changes introduced new PANW metricbeat fields, but the PANW exported-fields documentation still does not describe them.

## Changes Requiring Documentation Updates

### 1. New `ipsec_tunnel.state` field is emitted but undocumented

**Commit(s):**
- 2d47ee97e6c6d131a3908ad9f8a95758e2972bf9 (`[panw] Add state field to IPSec tunnels`)

**What changed:**
- `x-pack/metricbeat/module/panw/interfaces/tunnels.go` now emits `ipsec_tunnel.state` in event fields (line 135).

**Documentation impact:**
- PANW field source docs are still a stub in `x-pack/metricbeat/module/panw/_meta/fields.yml` (lines 1-9).
- Generated PANW reference page `docs/reference/metricbeat/exported-fields-panw.md` lists only placeholder examples (lines 19-32) and has no `ipsec_tunnel.state` entry.

### 2. New `observer.hostname` field is emitted for PANW events but not documented in PANW exported fields

**Commit(s):**
- 44dbd8d240a121537ca016dc3e101e7c262fd7bf (`[panw] add observer.hostname field`)

**What changed:**
- `x-pack/metricbeat/module/panw/util.go` adds `observer.hostname` to root fields when hostname is present (line 40).

**Documentation impact:**
- PANW field docs source (`x-pack/metricbeat/module/panw/_meta/fields.yml`) does not define this PANW mapping/context.
- `docs/reference/metricbeat/exported-fields-panw.md` has no PANW-specific documentation describing this addition.

## Suggested Actions

- [ ] Update `x-pack/metricbeat/module/panw/_meta/fields.yml` with PANW fields including `ipsec_tunnel.state` (type/description) and PANW usage/context for `observer.hostname`.
- [ ] Regenerate exported fields docs so `docs/reference/metricbeat/exported-fields-panw.md` includes accurate PANW field documentation.
- [ ] Verify docs mention these fields where PANW tunnel/system outputs are described to prevent user confusion.

## Verification notes

- Checked last 7 days commits (`git log --since="7 days ago"`) and commit diffs.
- Checked PANW exported fields docs and PANW fields source files directly.
- Searched open issues for an existing tracker (`is:issue is:open ... panw observer.hostname ipsec_tunnel.state metricbeat docs`) and found none.

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Docs Patrol](https://github.com/elastic/beats/actions/runs/23299396533)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on Mar 26, 2026, 2:29 PM UTC