Cherry-pick #18340 to 7.x: [Winlogbeat] Add support for FileDelete events (event id 23) to sysmon module

[marc-gr]

Cherry-pick of PR #18340 to 7.x branch. Original message:

What does this PR do?

FileDelete events were added in Sysmon v11, this PR adds support for FileDelete events (event id 23) to sysmon module.

Why is it important?

Prior to this change processing such events lead to an 'unexpected sysmon event_id' error message.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

TODO

• Diff the schema XML from v10 to v11 and make updates.
• Empty strings are replaced with “-“ to work around a WEF bug
• Handle Event ID 23
• Add .evtx test files from v11.

Related issues

Closes #18094

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[elasticmachine]

💚 Build Succeeded

Expand to view the summary

Build stats

• Build Cause: [Pull request Cherry-pick #18340 to 7.x: [Winlogbeat] Add support for FileDelete events (event id 23) to sysmon module #18371 opened]

• Start Time: 2020-05-08T06:57:01.035+0000

• Duration: 47 min 10 sec (2830222)

• Commit: 2e02ec3

Test stats 🧪

Test	Results
Failed	0
Passed	263
Skipped	1
Total	264