[CrowdStrike] Add support for HashSpreadingEvent and APIActivityAuditEvent

## Summary

Add support for two CrowdStrike Falcon Event Streams event types that are currently collected but not routed or ECS-mapped in the `falcon` data stream:

- `HashSpreadingEvent`
- `APIActivityAuditEvent`

## Target data stream: `falcon` (Event Streams)

These belong in the **`falcon`** data stream (Event Streams API / Falcon SIEM Connector), **not** `fdr` or `alert`.

Both use the standard Event Streams envelope (`metadata` + `event` with PascalCase fields).

## Current state: not supported

[`default.yml`](https://github.com/elastic/integrations/blob/main/packages/crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/default.yml) routes on `crowdstrike.metadata.eventType` and has dedicated branches for ~20 types (e.g. `AuthActivityAuditEvent`, `UserActivityAuditEvent`, `CustomerIOCEvent`, `FirewallMatchEvent`).

There is **no** branch for `HashSpreadingEvent` or `APIActivityAuditEvent`. Today these events fall through to generic enrichment only — event-specific fields are **not parsed, mapped, or categorized**.

They are also missing from the [supported Event Streams event types](https://github.com/elastic/integrations/blob/main/packages/crowdstrike/docs/README.md) list in the package docs.

> Note: `HashSpreadingEvent` was previously tracked in [#10550](https://github.com/elastic/integrations/issues/10550) alongside other types; that issue was closed after partial coverage without dedicated HashSpreading support.

## Event type notes

### `HashSpreadingEvent`

Indicates a file hash spreading across the environment. Known fields from CrowdStrike SIEM Connector CEF mappings include:

| Field | Notes |
| --- | --- |
| `event.FileName` | Spreading file name |
| `event.SHA256String` | File hash |
| `event.ExecutionType` | Execution / category context |
| `event.AlertTime` | Alert timestamp |
| `event.Sensors[]` | Per-host details (`HostnameField`, `Filename`, `LastWriteTime`, …) when subtype `HashSpreadingEvent_Sensors` is enabled |

Treat as a detection-style event (similar to `CustomerIOCEvent` / detection summaries): map file/hash/host fields and set ECS categorization accordingly.

### `APIActivityAuditEvent`

API request audit activity. Shape is close to other audit events (`AuthActivityAuditEvent` / `UserActivityAuditEvent`), with richer request attributes. Example shape:

```json
{
"metadata": {
"customerIDString": "...",
"offset": 570941,
"eventType": "APIActivityAuditEvent",
"eventCreationTime": 1750935017037,
"version": "1.0"
},
"event": {
"UserId": "",
"UserIp": "1.2.3.4",
"OperationName": "logged",
"ServiceName": "api_request",
"Success": true,
"UTCTimestamp": 1750935017,
"Attributes": {
"APIClientID": "...",
"cid": "...",
"request_method": "POST",
"request_path": "/path/to/something/v1/0",
"request_query": "...",
"status_code": "404",
"scopes": "streaming:read",
"trace_id": "...",
"user_agent": "...",
"user_ip": "1.2.3.4",
"elapsed_microseconds": "87719"
},
"Source": "api_request",
"SourceIp": "1.2.3.4",
"AuditKeyValues": [ ... ]
}
}