Seperate different utmp structure definitions (backport #40541)

[mergify]

The amd64 and arm64 utmp structures differ. The PR separates the definitions of the those structures, separates the test files, and separates the test data files.

The utmp structure is defined like this:

struct utmp {
               short   ut_type;              /* Type of record */
               pid_t   ut_pid;               /* PID of login process */
               char    ut_line[UT_LINESIZE]; /* Device name of tty - "/dev/" */
               char    ut_id[4];             /* Terminal name suffix,
                                                or inittab(5) ID */
               char    ut_user[UT_NAMESIZE]; /* Username */
               char    ut_host[UT_HOSTSIZE]; /* Hostname for remote login, or
                                                kernel version for run-level
                                                messages */
               struct  exit_status ut_exit;  /* Exit status of a process
                                                marked as DEAD_PROCESS; not
                                                used by Linux init(1) */
               /* The ut_session and ut_tv fields must be the same size when
                  compiled 32- and 64-bit.  This allows data files and shared
                  memory to be shared between 32- and 64-bit applications. */
           #if __WORDSIZE == 64 && defined __WORDSIZE_COMPAT32
               int32_t ut_session;           /* Session ID ([getsid(2)](https://man7.org/linux/man-pages/man2/getsid.2.html)),
                                                used for windowing */
               struct {
                   int32_t tv_sec;           /* Seconds */
                   int32_t tv_usec;          /* Microseconds */
               } ut_tv;                      /* Time entry was made */
           #else
                long   ut_session;           /* Session ID */
                struct timeval ut_tv;        /* Time entry was made */
           #endif

               int32_t ut_addr_v6[4];        /* Internet address of remote
                                                host; IPv4 address uses
                                                just ut_addr_v6[0] */
               char __unused[20];            /* Reserved for future use */
           };

The #define phrase, #if __WORDSIZE == 64 && defined __WORDSIZE_COMPAT32 is true amd64, but not for arm64. This makes the structure slightly larger for arm64. The structure definitions are separated out into os/architecture files. Likewise, the login_test.go has been renamed to login_linux_amd64_test.go. A new test file for arm64 utmp/btmp files was added and named login_linux_arm64_test.go. Finally, new utmp and btmp files generated on an arm64 system were added.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

How to test this PR locally

---

This is an automatic backport of pull request #40541 done by [Mergify](https://mergify.com).

[elasticmachine]

Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform)