Cherry-pick #19300 to 7.x: Update to go-libaudit v2.0.0

[andrewkroh]

Cherry-pick of PR #19300 to 7.x branch. Original message:

What does this PR do?

This updates the go-libaudit library to v2.0.0. Some of the updates since the last release were already
incorporated into Beats.

https://github.com/elastic/go-libaudit/releases/tag/v2.0.0

Fixes #14055 (seccomp field enrichments)
Fixes a few minor typos and spelling issues in auditd event.category and event.action values.

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[andrewkroh]

I've been seeing this unusual error from the Metricbeat tests:

[2020-07-15T08:36:14.406Z] + mage goIntegTest
[2020-07-15T08:37:22.185Z] Generated fields.yml for metricbeat to /var/lib/jenkins/workspace/Beats_beats_PR-19908/src/github.com/elastic/beats/metricbeat/fields.yml
[2020-07-15T08:37:22.185Z] Error: no module auditd
script returned exit code 1

I tracked down some discussion of it to #18592 (comment). In this case the MODULE=auditd but that's only an Auditbeat module. Similarly I saw this with a Filebeat module change that triggered Metricbeat to build and it failed for the same reason (logs). // fyi: @jsoriano @v1v

[v1v]

@andrewkroh , that particular misbehaviour was theoretically solved with #18777 and backported. I'll run some tests locally and see if i can reproduce the behaviour for this PR

[v1v]

I see what's going on:

• The pattern to search for should not be generic but specific per beat, in other words:

  beats/Jenkinsfile

  Lines 39 to 40 in 4dcbde3

  	XPACK_MODULE_PATTERN = '^x-pack\\/[a-z0-9]+beat\\/module\\/([^\\/]+)\\/.*'
  	OSS_MODULE_PATTERN = '^[a-z0-9]+beat\\/module\\/([^\\/]+)\\/.*'

should use <beatname> rather than [a-z0-9]+beat to avoid injecting the MODULE env variable to the Integration Tests stage that's related to another module.

If I recall we used the generic pattern to be easy to handle all the cases, but it seems it's not 100% accurate.

I've just raised #19986 to explain the reason of the issue and some test scenarios that should be verified when doing the implementation.

[andrewkroh]

Thanks @v1v !