[7.17](backport #30942) winlogbeat/sys/wineventlog: extend testing and fix bugs

[mergify]

This is an automatic backport of pull request #30942 done by Mergify.
Cherry-pick of 34bdc3d has failed:

On branch mergify/bp/7.17/pr-30942
Your branch is up to date with 'origin/7.17'.

You are currently cherry-picking commit 34bdc3d468.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	modified:   CHANGELOG.next.asciidoc
	modified:   winlogbeat/eventlog/wineventlog_test.go
	modified:   winlogbeat/sys/winevent/event.go
	modified:   winlogbeat/sys/winevent/event_test.go
	modified:   winlogbeat/sys/wineventlog/format_message.go
	modified:   winlogbeat/sys/wineventlog/query_test.go
	modified:   winlogbeat/sys/wineventlog/renderer.go
	modified:   winlogbeat/sys/wineventlog/renderer_test.go
	new file:   winlogbeat/sys/wineventlog/testdata/application-windows-error-reporting.xml
	new file:   winlogbeat/sys/wineventlog/testdata/ec1.evtx
	new file:   winlogbeat/sys/wineventlog/testdata/ec1.xml
	new file:   winlogbeat/sys/wineventlog/testdata/ec2.evtx
	new file:   winlogbeat/sys/wineventlog/testdata/ec2.xml
	new file:   winlogbeat/sys/wineventlog/testdata/ec3.evtx
	new file:   winlogbeat/sys/wineventlog/testdata/ec3.xml
	new file:   winlogbeat/sys/wineventlog/testdata/ec3and4.evtx
	new file:   winlogbeat/sys/wineventlog/testdata/ec3and4.xml
	new file:   winlogbeat/sys/wineventlog/testdata/ec4.evtx
	new file:   winlogbeat/sys/wineventlog/testdata/ec4.xml
	new file:   winlogbeat/sys/wineventlog/testdata/experimental.evtx
	new file:   winlogbeat/sys/wineventlog/testdata/experimental.xml
	new file:   winlogbeat/sys/wineventlog/testdata/original.evtx
	new file:   winlogbeat/sys/wineventlog/testdata/original.xml
	new file:   winlogbeat/sys/wineventlog/testdata/sysmon-9.01.xml
	modified:   winlogbeat/sys/wineventlog/wineventlog_windows_test.go

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   winlogbeat/Jenkinsfile.yml
	both modified:   winlogbeat/beater/winlogbeat.go
	both modified:   winlogbeat/eventlog/wineventlog.go
	both modified:   winlogbeat/eventlog/wineventlog_experimental.go
	both modified:   winlogbeat/sys/wineventlog/wineventlog_windows.go
	both modified:   x-pack/winlogbeat/Jenkinsfile.yml

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/github/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

---

Mergify commands and options

More conditions and actions can be found in the documentation.

You can also trigger Mergify actions by commenting on this pull request:

• @Mergifyio refresh will re-evaluate the rules
• @Mergifyio rebase will rebase this PR on its base branch
• @Mergifyio update will merge the base branch into this PR
• @Mergifyio backport <destination> will backport this PR on <destination> branch

Additionally, on Mergify dashboard you can:

• look at your merge queues
• generate the Mergify configuration with the config editor.

Finally, you can contact us on https://mergify.com

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2022-05-03T01:20:30.271+0000

• Duration: 90 min 23 sec

Test stats 🧪

Test	Results
Failed	0
Passed	20219
Skipped	1545
Total	21764

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

• /package : Generate the packages and run the E2E tests.

• /beats-tester : Run the installation tests with beats-tester.

• run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

[efd6]

Blocked on #31042

[mergify]

This pull request has not been merged yet. Could you please review and merge it @efd6? 🙏

[mergify]

This pull request has not been merged yet. Could you please review and merge it @efd6? 🙏

[mergify]

This pull request has not been merged yet. Could you please review and merge it @efd6? 🙏

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b mergify/bp/7.17/pr-30942 upstream/mergify/bp/7.17/pr-30942
git merge upstream/7.17
git push upstream mergify/bp/7.17/pr-30942

[mergify]

This pull request has not been merged yet. Could you please review and merge it @efd6? 🙏

[efd6]

Depends on parts of #31464 which won't be back ported to this change (they will be cherry picked to here when that PR is approved).

1. The change in winlogbeat/eventlog/wineventlog.go adding meta data to the winevent.EnrichRawValuesWithNames call.
2. The change in x-pack/winlogbeat/module/powershell/test/powershell_windows_test.go conditionally ignoring the winlog.opcode field on Windows 2022 and dependent change in x-pack/winlogbeat/module/testing_windows.go to block golden file generation on that version.

[mergify]

This pull request has not been merged yet. Could you please review and merge it @efd6? 🙏

[efd6]

@andrewkroh Please take a quick look at the last commit here; it's the relevant parts of #31464 for 7.17 to get 2022 to pass. It's large but the same as happened there less the recovery of testing.