[Fortinet FortiGate Firewall Logs]: Improve ECS related.user Field Mapping for Fortinet

### Integration Name

Fortinet FortiGate Firewall Logs [packages/fortinet_fortigate]

### Dataset Name

fortinet_fortigate.log

### Integration Version

1.36.8

### Agent Version

8.18.8

### OS Version and Architecture

Debian 12

### User Goal

Hello,

The ECS field related.user could be improved.

The related.user field should aggregate all user-related fields (e.g., user, unauthuser) into a list of unique usernames to ensure consistency with ECS standards.

Would it be possible to update the mapping logic to handle this case? Let me know if you need further details or logs for testing.

Regards,

BBA

### Existing Features

Currently, for events like the one below, related.user is set to the value of the field source.user.name "User_B" and not fortinet.firewall.user "User_A"

### What did you see?

example of event :
```json
"original": "<189>date=2026-07-29 time=16:01:52 devname=\"FortiGate\" devid=\"FortigateID\" eventtime=1785333711391645902 tz=\"+0200\" logid=\"0000000013\" type=\"traffic\" subtype=\"forward\" level=\"notice\" vd=\"root\" srcip=192.168.1.10 srcname=\"MyPC \" srcport=59144 srcintf=\"LAN\" srcintfrole=\"lan\" dstip=10.10.10.10 dstport=53 dstintf=\"DST_INF\" dstintfrole=\"lan\" srccountry=\"Reserved\" dstcountry=\"Reserved\" sessionid=998282275 proto=17 action=\"accept\" policyid=743 policytype=\"policy\" poluuid=\"903e1662-6407-51f1-c637-951e1f47ff7c\" policyname=\"POLICYNAME\" user=\"User_A\" authserver=\"FSSO_DC\" service=\"DNS\" trandisp=\"noop\" appcat=\"unscanned\" duration=180 sentbyte=102 rcvdbyte=219 sentpkt=1 rcvdpkt=1 osname=\"Windows\" srcswversion=\"10/11\" unauthuser=\"User_B\" unauthusersource=\"kerberos\" mastersrcmac=\"aa:bb:cc:dd:ee:ff\" srcmac=\"aa:bb:cc:dd:ee:ff\" srcserver=0 dsthwvendor=\"Cisco\" masterdstmac=\"aa:bb:cc:dd:ee:ff\" dstmac=\"aa:bb:cc:dd:ee:ff\" dstserver=0"
```
actual parsing ofor related.user:

### Anything else?

for an explanation of the purpose of user vs authuser in FortiGate you can look at:
`https://community.fortinet.com/fortigate-3/troubleshooting-tip-unauthuser-and-unauthusersource-102139`

The Fortinet version that generate this syslog is in version 7.4.12.

Start in packages/fortinet_fortigate and inspect the fortinet_fortigate.log mapping for related.user. Verify the mapping with the supplied event containing user=User_A and unauthuser=User_B; done means related.user contains both unique usernames and follows the requested ECS behavior.

Written by the indexing model from the issue text.