Operating System field for Linux, Windows, macOS

It is hard to identify Linux events today. This would be useful, for example when looking at centralized logs from different devices - logs from the major operating systems (Linux, Windows, macOS) are very different. It often makes sense to be able to pull them apart and visualize/look at them separately and write rules/alerts that are specific to each.

None of the fields in the OS field set contain `linux` as a value, so the only way today to get all Linux events is to exclude all non-Linux events. That's not great.

What we have today:
- **os.family**
- Documentation: `redhat`, `debian`, `freebsd`, `windows`
- Values in the wild (internal cluster): `redhat`, `debian`, `darwin`, `windows`
- **os.platform**
- Documentation: `centos`, `ubuntu`, `windows`
- Values in the wild: `debian`, `ubuntu`, `centos`, `darwin`, `windows`, `raspbian`, `ol`, `opensuse-leap`
- **os.full**
- Documentation: `Mac OS Mojave`
- Values in the wild: None (Libbeat's `add_host_metadata` does not fill it)
- **os.name**
- Documentation: `Mac OS X`
- Values in the wild: `Debian GNU/Linux`, `Oracle Linux Server`, `Windows Server 2019 Datacenter`, `Windows 8.1 Enterprise Evaluation`

I think we should have a field that contains one value each for Linux, Windows, and macOS. Beats and other Go-based agents could fill it with the value of [`runtime.GOOS`](https://golang.org/pkg/runtime/#pkg-constant) and we could take the list of possible GOOS values as the accepted values of this field (this would be `linux`, `darwin`, `windows` for the major three, the full list is [here](https://github.com/golang/go/blob/master/src/go/build/syslist.go#L7)).

As to which fields, we could:
- Introduce a new field, such as `os.type`.
- Re-purpose one of the existing fields, either `os.family` or `os.platform`.

/cc @webmat @MikePaquette @andrewkroh @ruflin