x-pack/filebeat/input/cel: add envvar support

[efd6]

Proposed commit message

See title.

Note that the example shown for allowed_environment can be demonstrated by adding the following.

diff --git a/x-pack/filebeat/input/cel/input_test.go b/x-pack/filebeat/input/cel/input_test.go
index 44ad39435b..9409c4f855 100644
--- a/x-pack/filebeat/input/cel/input_test.go
+++ b/x-pack/filebeat/input/cel/input_test.go
@@ -411,6 +411,31 @@ var inputTests = []struct {
                        {"message": "not present"},
                },
        },
+       {
+               name: "env_var_path",
+               config: map[string]interface{}{
+                       "interval": 1,
+                       "allowed_environment": []string{
+                               "PATH",
+                       },
+                       "program": `{
+                               "events": {
+                                       "message": env.?PATH.orValue("").split(":")
+                                               .map(p, try(dir(p)))
+                                               .filter(r, type(r) != type(""))
+                                               .flatten()
+                                               .collate("name")
+                               }
+                       }`,
+                       "state": nil,
+                       "resource": map[string]interface{}{
+                               "url": "",
+                       },
+               },
+               want: []map[string]interface{}{
+                       {"message": ""}, // This will fail, but will show the diff.
+               },
+       },
 
        // FS-based tests.
        {

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Disruptive User Impact

Author's Checklist

• [ ]

How to test this PR locally

Related issues

• For [Filebeat] cel - support AWS request signing #40762

Use cases

Screenshots

Logs

[mergify]

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @efd6? 🙏.
For such, you'll need to label your PR with:

• The upcoming major version of the Elastic Stack
• The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit

[mergify]

backport-8.x has been added to help with the transition to the new branch 8.x.

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b 40762-cel upstream/40762-cel
git merge upstream/main
git push upstream 40762-cel

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b 40762-cel upstream/40762-cel
git merge upstream/main
git push upstream 40762-cel

[andrewkroh]

LGTM

[andrewkroh]

Suggested change

	PATH
	- PATH