Fix/checkpoint session logs

[srilumpa]

• Enhancement
• Breaking change ?

Proposed commit message

This PR aims to handle Check Point firewall session logs in reagrd of the ECS structure.

Session logs are used to aggregate multiple connection logs from the same network activity into a single event. This aggregation adds a few fields:

• creation_time records the time (as an UNIX timestamp) of the first connection for the current session
• last_hit_time records the time (as an UNIX timestamp) of the last recorded connection for the current session
• duration records the duration (in seconds) of the session
• aggregated_log_count counts the amount of connection logs aggregated in this session log
• connection_count counts the amount of connection recorded in the session log
• update_count counts the number of time the session was updated

This PR will:

• interprets creation_time and last_hit_time as a date and stores them into the ECS fields event.start and event.end respectively
• convert duration to a nanoseconds duration as per the ECS event.duration specification and stores it into the expected event.duration` field
• ensure checkpoint.aggregated_log_count, checkpoint.connection_count and checkpoint.update_count are mapped to a numeric type

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

How to test this PR locally

Related issues

• Closes [Checkpoint]: Processing and mapping of Checkpoint Firewall session logs #11894

[elasticmachine]

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

[srilumpa]

BTW, I mentioned it in the changelog but not in the PR commit message but this change will probably result in a mapping change for the three non-ECS fields (checkpoint.aggregated_log_count, checkpoint.connection_count and checkpoint.update_count) as they were dynamically mapped to a keyword but are now mapped to an integer.