[Fortinet Fortigate]: IPS direction field wrong

### Integration Name

Fortinet FortiGate Firewall Logs [fortinet_fortigate]

### Dataset Name

fortinet_fortigate.log

### Integration Version

1.27.0

### Agent Version

8.17.0

### Agent Output Type

elasticsearch

### Elasticsearch Version

8.15.0

### OS Version and Architecture

SLES 15-SP5

### Software/API Version

_No response_

### Error Message

Elastic-Agent integration does not calculate the correct value for network.direction

### Event Original

1,Jan 23 14:20:12,,date=2025-01-23, time=14:20:12 devname="" devid="" eventtime=1737638412712471545 tz="+0100" logid="" type="utm" subtype="ips" eventtype="signature" level="alert" vd="datacenter" severity="medium" srcip=172.20.100.100 srccountry="Reserved" dstip=172.20.50.50 dstcountry="Reserved" srcintf="srv1" srcintfrole="lan" dstintf="vlan1" dstintfrole="lan" sessionid=3816590000 action="detected" proto=17 service="SNMP" policyid=1321 poluuid="" policytype="policy" attack="ISF.Creds.SNMP.BruteForce" srcport=62000 dstport=161 direction="outgoing" attackid=49360 profile="IPS-To-Client" ref="http://www.fortinet.com/ids/VID49360" incidentserialno=249098617 msg="SCADA: ISF.Creds.SNMP.BruteForce" crscore=10 craction=16384 crlevel="medium"

### What did you do?

Collect Fortinet FortiGate logs (input: logfile)

internal.networks: private

### What did you see?

network.direction: outbound

### What did you expect to see?

srcip and dstip is internal

`srcip=172.20.100.100 srccountry="Reserved" dstip=172.20.50.50`

I would have expected to see `network.destination: internal`

### Anything else?

In the original ips logs there exists a field `direction=`, it seems this is somehow used for network.direction?

This might help understanding the issue between network.direction for ips and traffic logs: https://docs.fortinet.com/document/fortigate/6.2.0/new-features/199570/logging-session-versus-attack-direction