[system] Support processing of AD FS logs

When using the [system.security integration](https://www.elastic.co/docs/current/integrations/system#system), the agent is parsing the ADFS server name and service user name (copied from **winlog.computer_name** and **winlog.user.name**) into the "host.name" and "user.name" fields for the event. On the other hand, Kerberos events (for instance event id 4768), overwrite "user.name" with the authenticating user information.

It would be useful to have specific processing for [AD FS events — with ids between 1200 and 1210](https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/troubleshooting/ad-fs-tshoot-logging#types-of-events).

The list at https://github.com/elastic/integrations/issues/3769 that track what is parsed with the system.security integration doesn't include these events in particular.