[auditd] Add coalesced event support: manifest, pipeline, fields, dashboards

Update the `auditd` integration package to support coalesced
multi-record events produced by the new filestream parser mode
(elastic/beats#52556).

Parent: #19080

## Context

The beats coalescing parser (elastic/beats#52556) will emit compound
events with fields in the `auditd.data.*` namespace, matching the
`auditd_manager` field schema. The integration package needs
corresponding updates to its manifest, ingest pipeline, field
definitions, and dashboards.

## Work

**Manifest.** Add a `parser_mode` three-state setting
(`none | parse | coalesce`, default `none`), replacing the existing
`use_auditd_parser` boolean. Bump the semver gate to the minimum
agent version that includes the coalescing parser. Include a migration
note for the setting rename.

**Ingest pipeline.** Add processors for coalesced events, guarded by
`ctx.auditd?.message_type != null`:
- Type conversions for numeric fields (`process.pid`, `user.id`, etc.)
matching the `auditd_manager` pipeline.
- Null field stripping (Painless script matching `auditd_manager`).
- Conditional `auditd.messages` removal when
`preserve_original_event` is not set.

**Field definitions.** Add ~240 `auditd.data.*` fields plus
`auditd.summary.*`, `auditd.user.*`, `auditd.file.*`,
`auditd.paths`, `auditd.messages`, `auditd.message_type`,
`auditd.session`, `auditd.result`, `auditd.warnings`, and
`auditd.data.node`. Derive from the `auditd_manager` package's
existing field definitions. Existing `auditd.log.*` definitions
remain for the legacy and Phase 1 paths.

**Dashboards.** Update panel references from `auditd.log.*` to
`auditd.data.*`.

## Follow-up coordination

After this ships, coordinate with the detection-rules team to broaden
index patterns on 131 rules to include `logs-auditd.log-*` and fix
3 rules with hard-coded `data_stream.dataset` filters. This requires
first verifying no field type conflicts between `logs-auditd.log-*`
and `logs-auditd_manager.auditd-*` index templates.

## References

- Beats coalescing parser: elastic/beats#52556
- Phase 1 integration toggle: #19071
- Phase 1 parser: elastic/beats#50791