[Filebeat] Add source.as.organization.name to cloudtrail fileset

[leehinman]

Describe the enhancement:
Add source.as.organization.name to cloudtrail fileset

- geoip:
    database_file: GeoLite2-ASN.mmdb
    field: source.ip
    target_field: source.as
    properties:
    - asn
    - organization_name
    ignore_missing: true
- rename:
    field: source.as.organization_name
    target_field: source.as.organization.name
    ignore_missing: true
- rename:
    field: destination.as.asn
    target_field: destination.as.number
    ignore_missing: true

Describe a specific use case for the enhancement or feature:

** Backport
7.6, 7.7, 7.8, 7.x

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[randomuserid]

We could use this both in rules and ML jobs for CloudTrail events. Most CloudTrail events are just records of API method calls which are often not inherently suspicious. The ability to consider the attributes of the client or caller network will be important in addition to the user context or creds.