Cherry-pick #11231 to 7.0: Use process.name and event.outcome in filebeat system auth module

[jsoriano]

Cherry-pick of PR #11231 to 7.0 branch. Original message:

Before migration to ECS (#9138), we could rely on the presence of specific
fields to know the process originating the events, but this is not so reliable
after some of these fields have been moved to common places. Add
process.name also for known messages so we keep this info in a known
place.

Also use event.outcome instead of event.action for the result of the
logged action.