[teleport] teleport.audit.kubernetes.pod.container_name and container_image mapped as flattened but value is a plain string

### Integration Name

Teleport [packages/teleport]

### Dataset Name

_No response_

### Integration Version

1.6.0

### Agent Version

9.2.6

### Agent Output Type

elasticsearch

### Elasticsearch Version

9.2.6

### OS Version and Architecture

RHEL 9.7 amd64

### Software/API Version

_No response_

### Error Message

```
document_parsing_exception: failed to parse field [teleport.audit.kubernetes.pod.container_name] of type [flattened]
```

### Event Original

```
{
"error": {
"type": "document_parsing_exception",
"message": "failed to parse field [teleport.audit.kubernetes.pod.container_name] of type [flattened]"
},
"document": {
"source": {
"event": { "action": "kube.request" },
"teleport": {
"audit": {
"kubernetes": {
"pod": {
"container_name": "nginx",
"container_image": "nginx:latest"
}
}
}
}
}
}
}
```

### What did you do?

Ingested Teleport audit logs for kube.request events where kubernetes_container_name and kubernetes_container_image are plain string values. The event-groups pipeline renames these to teleport.audit.kubernetes.pod.container_name and teleport.audit.kubernetes.pod.container_image before indexing.

### What did you see?

The flattened mapping type rejects plain string values for both container_name and container_image.

### What did you expect to see?

The mapping for teleport.audit.kubernetes.pod.container_name and teleport.audit.kubernetes.pod.container_image should accept plain string values. A keyword mapping would be appropriate for these fields.

### Anything else?

Suggested fix
Change the mapping type for teleport.audit.kubernetes.pod.container_name and teleport.audit.kubernetes.pod.container_image from flattened to keyword.

Current workaround
Using a rename processor with an instanceof String condition to move the value to a _value-suffixed field (container_name_value, container_image_value) when the field is a plain string.