[teleport] teleport.audit.kubernetes.groups and .users mapped as flattened but Teleport sends plain strings or string arrays

### Integration Name

Teleport [packages/teleport]

### Dataset Name

_No response_

### Integration Version

1.6.0

### Agent Version

9.2.6

### Agent Output Type

elasticsearch

### Elasticsearch Version

9.2.6

### OS Version and Architecture

RHEL 9.7 amd64

### Software/API Version

_No response_

### Error Message

```
document_parsing_exception: failed to parse field [teleport.audit.kubernetes.groups] of type [flattened].
Preview of field's value: 'flcc-baremetalnode-write-role'
```

### Event Original

```
{
"error": {
"type": "document_parsing_exception",
"message": "failed to parse field [teleport.audit.kubernetes.groups] of type [flattened]. Preview of field's value: 'flcc-baremetalnode-write-role'"
},
"document": {
"source": {
"event": { "action": "kube.request", "code": "T3009I" },
"teleport": {
"audit": {
"kubernetes": {
"groups": [
"flcc-baremetalnode-write-role",
"k8s_teleport_viewers",
"rack-read-role",
"system:authenticated"
],
"users": ["redacted@example.com"]
}
}
}
}
}
}
```

### What did you do?

Ingested Teleport audit logs for kube.request events (code T3009I) containing kubernetes.groups and kubernetes.users fields populated with plain strings or simple string arrays.

### What did you see?

```
document_parsing_exception: failed to parse field [teleport.audit.kubernetes.groups] of type [flattened].
Preview of field's value: 'flcc-baremetalnode-write-role'
```

### What did you expect to see?

The mapping for teleport.audit.kubernetes.groups and teleport.audit.kubernetes.users should accept the string and string array values that Teleport actually sends. A keyword mapping would be appropriate for these fields.

### Anything else?

Suggested Fix
Change the mapping type for teleport.audit.kubernetes.groups and teleport.audit.kubernetes.users from flattened to keyword.

Workaround
Forcing keyword via a custom index template override on the logs-teleport.audit@custom component template.