[trellix_epo_on_prem] Improve ECS event categorization across threat_event, product_event, dlp_incident and syslog event data streams

Refines ECS categorization and severity mapping across four data streams, based on Trellix ePO event-code semantics validated against production event samples.

### `threat_event`
- Added event-code driven mappings for validated codes, setting `event.kind`, `event.action`, `event.category`, `event.type` and `event.outcome` per code instead of static values.
- Derived `event.outcome` dynamically from `ThreatActionTaken` and `ThreatHandled` so blocked, would-block (audit mode) and failed actions are distinguished.
- Mapped `ThreatSeverity` to ECS `event.severity` and removed the duplicate vendor field.
- Split `TargetPath` by destination type: registry hives (`HK*`) now map to `registry.path`, filesystem paths to `file.directory`.

### `product_event`
- Added mappings for validated `TVDEventID` codes, setting `event.action`, `event.kind` and `event.outcome`, and appending ECS-valid `event.category` and `event.type` values.
- Differentiated install vs. uninstall deployment events that share a single event code.

### `dlp_incident`
- Mapped incident `Severity` to ECS `event.severity` and removed the duplicate vendor field.

### `event` (syslog)
- Removed the blanket categorization that applied an identical `event.category` and `event.type` to every event regardless of content.
- Added event-code driven categorization for validated codes; unmapped events now carry only `event.kind` rather than asserting an incorrect category.
- Added `event.outcome` derived from `ThreatHandled`, `event.severity` from `ThreatSeverity`, and the same `TargetPath` registry/filesystem split.
- Normalized `event.action` to lowercase hyphenated form.

Pipeline tests, sample events, dashboards and documentation were updated accordingly.

Part of #20363.