[Audit]: User.name populated wrongly in parsed document

### Integration Name

Auditd Logs [packages/auditd]

### Dataset Name

auditd.log

### Integration Version

3.23.2

### Agent Version

8.16.5

### Agent Output Type

logstash

### Elasticsearch Version

9.3.3.

### OS Version and Architecture

Oracle Linux Server (86_64

### Software/API Version

NA

### Error Message

No error message.

### Event Original

type=USER_CHAUTHTOK msg=audit(1785340698.461:91832): pid=4556 uid=0 auid=605828863 ses=10323 subj=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 msg='op=PAM:chauthtok grantors=pam_pwquality,pam_unix acct=""testsiemlog"" exe=""/usr/bin/passwd"" hostname=r21cshewrk16 addr=? terminal=pts/2 res=success

### What did you do?

Source Host -> Elastic Agent -> Logstash -> Kafka -> Logstash -> Elasticsearch

### What did you see?

For the above USER_CHAUTHTOK event, the pipeline populates both:

"user": {
"name": "testsiemlog"
},
"user": {
"target": {
"name": "testsiemlog"
}
}

The value of user.target.name is correct because the account specified in acct="testsiemlog" is the account whose credentials are being modified.

However, the pipeline is also populating user.name with the same value (testsiemlog). This appears to be incorrect because user.name should represent the user performing the action, while user.target.name should represent the user account being acted upon.

In this event:

uid=0 indicates the operation was executed by the root user.
acct="testsiemlog" indicates the target account affected by the operation.
As a result, user.name and user.target.name should not be populated with the same value.

This mapping makes it appear that the target account modified its own password, which is not always true and can lead to inaccurate attribution during security investigations.

### What did you expect to see?

The ECS fields should distinguish between the actor and the target account.

Expected mapping:

{
"user": {
"effective": {
"name": "root"
}
},
"user": {
"target": {
"name": "testsiemlog"
}
}
}

if the acting username cannot be reliably determined from the event, user.name should remain unset rather than being duplicated from the target account.

### Anything else?

_No response_

Start in packages/auditd and trace how the USER_CHAUTHTOK event maps acct and uid into ECS user fields. Compare the parsed output with the expected actor-versus-target mapping, and verify that user.name is unset or represents the actor rather than duplicating user.target.name.

Written by the indexing model from the issue text.