[Github Audit] Field github.filtered_request_body.query is a copy of github.query_string and should be removed.

Hello,

The field `github.filtered_request_body.query` will be present when `event.action` is `api.request` and the request is a graphql query (`github.route: /graphql`).

In this case both `github.filtered_request_body.query` and `github.query_string` will be populated with the same content, which can be pretty long.

On my data all documents that have `github.filtered_request_body.query` also have `github.query_string` with the same value, there are no documents where `github.filtered_request_body.query` exists but `github.query_string` does not exist, but I can have `github.query_string` without having `github.filtered_request_body.query` on requests that are not graphql.

Github audit logs send both fields, currently we are going to remove `github.filtered_request_body.query` using a custom ingest pipeline, but shouldn't this be removed per default to avoiding using unnecessary extra storage?