[teleport] teleport.audit.user.connector mapped as flattened but Teleport sends a plain string

### Integration Name

Teleport [packages/teleport]

### Dataset Name

_No response_

### Integration Version

1.6.0

### Agent Version

9.2.6

### Agent Output Type

elasticsearch

### Elasticsearch Version

9.2.6

### OS Version and Architecture

RHEL 9.7 (amd64)

### Software/API Version

_No response_

### Error Message

```
document_parsing_exception: failed to parse field [teleport.audit.user.connector] of type [flattened]
```

### Event Original

_No response_

### What did you do?

Ingested Teleport audit log events where the user.connector field is populated with a plain string value (e.g. an authentication connector name).

### What did you see?

The flattened mapping type rejects plain string values — it expects an object.

### What did you expect to see?

The mapping for teleport.audit.user.connector should accept the plain string values that Teleport sends. A keyword mapping would be appropriate for this field.

### Anything else?

Suggested fix
Change the mapping type for teleport.audit.user.connector from flattened to keyword.

Current workaround
Using a convert processor with type: string in a custom pipeline to coerce the value before it reaches the mapping.