Auditbeat: Propagate output backpressure in socket dataset

[adriansr]

Describe the enhancement:

The socket dataset tracks network flows to/from processes on a Linux system using kprobe tracepoints on the kernel's TCP/IP stack.

Currently, an unbounded linked list is used to store flows ready to be reported to the output. A system with a lot of network I/O can generate events faster than they can be delivered to the output, meaning this linked list grows without limits causing more and more memory to be used by the Auditbeat process.

The dataset needs to receive backpressure from the output to avoid using too much memory.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)