[Filestream] Cannot correctly configure `close.on_state_change.removed` on Windows

`close.on_state_change.removed` is defined in the input template as:
```yaml
{{#if close_on_state_changed_removed}}
close.on_state_change.removed: {{close_on_state_changed_removed}}
{{/if}}
```

Because of the `#if` condition, the configuration key is only rendered when *enabled*, so if the toggle is not set, the Filestream defaults are applied.

However `close.on_state_change.removed` has [different defaults](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-filestream#filebeat-input-filestream-close-removed) depending on the OS:
- `true` for Windows
- `false` for all other OSes.

Because `false` does not render the configuration block, it is impossible to disable this option on Windows.

----
This goes beyond just updating the integration, this case requires a "tri-state boolean": `false`, `true` and `not-set`. Currently we don't support this in Fleet UI.

Start with the Filestream input template shown in the issue and trace how the Fleet UI represents the close_on_state_changed_removed toggle. Done means the setting can explicitly represent true, false, and not-set, rendering false so Windows users can disable the option while preserving platform defaults when it is not set.

Written by the indexing model from the issue text.