[ECS] align with ECS observer fieldset

[axw]

APM Server and (potentially other beats acting as an observer) sends several observer fields that are not part of the ECS fieldset definition:

• observer.ephemeral_id
• observer.id

We should propose a change to the ECS observer fieldset, to include these fields.

In the case of observer.version_major, we would probably want to wait for a resolution on elastic/elasticsearch#48878; rather than continuing to store the major version, we would instead store a semver tuple. See also elastic/ecs#842. version_major was removed in #7399