[system][auth] Remove deprecated user.name/user.id duplication for IAM events

Contract phase of the expand-and-contract migration started in 2.22.0
(#20339): the auth data stream no longer writes the
affected account to user.name/user.id for useradd account creation,
usermod group membership, userdel deletion, and PAM password change
events. The affected account remains in user.target.name (and
user.target.id for useradd); user.name on these events is reserved for
the acting user, matching ECS semantics. On journald input, useradd
events now keep the actor UID from journald metadata in user.id instead
of having it overwritten by the created account's UID.

Mechanically this deletes the five *_compat processors that 2.22.0
introduced for backward compatibility and regenerates the pipeline test
expectations, whose diff is exactly the removal of the duplicated
fields.

Ships as 3.0.0 with a breaking-change changelog entry so Kibana
requires users to acknowledge the change before upgrading. The bundled
New users and groups dashboard already reads user.target.* as of
2.23.0.

Author: nicholasberlin

packages/system/changelog.yml

@@ -1,4 +1,10 @@
 # later versions go on top
+- version: "3.0.0"
+  changes:
+    - description: >-
+        The auth data stream no longer writes the affected account to `user.name`/`user.id` for useradd account creation, usermod group membership, userdel deletion, and PAM password change events. Since system 2.22.0 the affected account is available in `user.target.name` (and `user.target.id` for useradd), and `user.name` on these events is reserved for the acting user, matching ECS semantics. This completes the deprecation announced in 2.22.0. Before upgrading, update detection rules, saved searches, dashboards, and other content that reads the affected account from `user.name`/`user.id` on these events to use `user.target.*` instead — content still keyed on `user.name` will stop matching these events after this upgrade. The bundled New users and groups dashboard already uses `user.target.*` as of 2.23.0.
+      type: breaking-change
+      link: https://github.com/elastic/integrations/issues/20105
 - version: "2.23.0"
   changes:
     - description: >-

packages/system/data_stream/auth/_dev/test/pipeline/test-auth-debian11-preserve-original.json-expected.json

@@ -89,8 +89,7 @@
                     },
                     "id": "0"
                 },
-                "id": "107",
-                "name": "systemd-journal-remote",
+                "id": "1000",
                 "target": {
                     "id": "107",
                     "name": "systemd-journal-remote"
@@ -982,7 +981,6 @@
                     "id": "0"
                 },
                 "id": "1000",
-                "name": "foo",
                 "target": {
                     "name": "foo"
                 }
@@ -1061,7 +1059,6 @@
                     "id": "0"
                 },
                 "id": "1000",
-                "name": "foo",
                 "target": {
                     "name": "foo"
                 }
@@ -1140,7 +1137,6 @@
                     "id": "0"
                 },
                 "id": "1000",
-                "name": "foo",
                 "target": {
                     "name": "foo"
                 }
@@ -1360,7 +1356,6 @@
                     "id": "0"
                 },
                 "id": "1000",
-                "name": "fred",
                 "target": {
                     "name": "fred"
                 }

packages/system/data_stream/auth/_dev/test/pipeline/test-auth-debian11.json-expected.json

@@ -86,8 +86,7 @@
                     },
                     "id": "0"
                 },
-                "id": "107",
-                "name": "systemd-journal-remote",
+                "id": "1000",
                 "target": {
                     "id": "107",
                     "name": "systemd-journal-remote"
@@ -949,7 +948,6 @@
                     "id": "0"
                 },
                 "id": "1000",
-                "name": "foo",
                 "target": {
                     "name": "foo"
                 }
@@ -1025,7 +1023,6 @@
                     "id": "0"
                 },
                 "id": "1000",
-                "name": "foo",
                 "target": {
                     "name": "foo"
                 }
@@ -1104,7 +1101,6 @@
                     "id": "0"
                 },
                 "id": "1000",
-                "name": "foo",
                 "target": {
                     "name": "foo"
                 }
@@ -1315,7 +1311,6 @@
                     "id": "0"
                 },
                 "id": "1000",
-                "name": "fred",
                 "target": {
                     "name": "fred"
                 }

packages/system/data_stream/auth/_dev/test/pipeline/test-auth-rhel79.log-expected.json

@@ -83,7 +83,6 @@
                 "auth": {}
             },
             "user": {
-                "name": "jce",
                 "target": {
                     "name": "jce"
                 }
@@ -129,7 +128,6 @@
                 "auth": {}
             },
             "user": {
-                "name": "acris",
                 "target": {
                     "name": "acris"
                 }

packages/system/data_stream/auth/_dev/test/pipeline/test-auth-ubuntu1204.log-expected.json

@@ -2477,8 +2477,6 @@
                 }
             },
             "user": {
-                "id": "1001",
-                "name": "tsg",
                 "target": {
                     "id": "1001",
                     "name": "tsg"
@@ -2526,7 +2524,6 @@
                 "auth": {}
             },
             "user": {
-                "name": "tsg",
                 "target": {
                     "name": "tsg"
                 }
@@ -4803,8 +4800,6 @@
                 }
             },
             "user": {
-                "id": "106",
-                "name": "mysql",
                 "target": {
                     "id": "106",
                     "name": "mysql"

packages/system/data_stream/auth/_dev/test/pipeline/test-auth.log-expected.json

@@ -553,8 +553,6 @@
                 }
             },
             "user": {
-                "id": "48",
-                "name": "apache",
                 "target": {
                     "id": "48",
                     "name": "apache"

packages/system/data_stream/auth/_dev/test/pipeline/test-pam-chauthtok-iso8601.log-expected.json

@@ -40,7 +40,6 @@
                 "auth": {}
             },
             "user": {
-                "name": "user123",
                 "target": {
                     "name": "user123"
                 }

packages/system/data_stream/auth/_dev/test/pipeline/test-pam-extraction.log-expected.json

@@ -143,7 +143,6 @@
                 "auth": {}
             },
             "user": {
-                "name": "jsmith",
                 "target": {
                     "name": "jsmith"
                 }

packages/system/data_stream/auth/_dev/test/pipeline/test-userdel.log-expected.json

@@ -138,7 +138,6 @@
                 "auth": {}
             },
             "user": {
-                "name": "siem_test",
                 "target": {
                     "name": "siem_test"
                 }

packages/system/data_stream/auth/_dev/test/pipeline/test-usermod-group.log-expected.json

@@ -44,7 +44,6 @@
                 "auth": {}
             },
             "user": {
-                "name": "testuser",
                 "target": {
                     "name": "testuser"
                 }
@@ -94,7 +93,6 @@
                 "auth": {}
             },
             "user": {
-                "name": "testuser",
                 "target": {
                     "name": "testuser"
                 }