[Windows System Integration]: Value of winlog.logon.id for event 4624 and 4627

### Integration Name

System [packages/system]

### Dataset Name

_No response_

### Integration Version

2.20.0

### Agent Version

9.4.2

### Agent Output Type

elasticsearch

### Elasticsearch Version

9.4.2

### OS Version and Architecture

Windows 11

### Software/API Version

_No response_

### Error Message

As described in the official Microsoft documentation, the logon id value allows to correlate login/logout events (4624,4672 and 4634/4647), which is the winlog.logon.id when the event is ingested in ES
It seems that for event 4624 the value winlog.logon.id it is populated from the wrong field (SubjectLogonId instead of TargetLogonId) making a little bit tricky to correlate events. IMHO, value of the TargetLogonId should be populated in the winlog.logon.id to be consistent
Same happens with event 4627

### Event Original

_No response_

### What did you do?

I complete the sequence Login -> Login Special -> Logout to have all the examples of 4624,4672,4634 and 4647 events

### What did you see?

In the case of event 4624 winlog.logon.id is set with 0xe37 or 0x0 instead of the TargetLogonId

### What did you expect to see?

same value of winlog.logon.id across all the login/logout events to correlate between events

### Anything else?

_No response_