[GCP] Preserve original value of resource name

[moxarth-rathod]

Proposed commit message

GCP : Add gcp.audit.resource_name for k8s audit logs

Remove condition on json.protoPayload.resourceName to preserve original value. This field is used to
extract orchestrator-related information in Kubernetes logs, and grok is already applied for extracting
details. Removing the condition helps retain the original value.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

• Clone integrations repo.
• Install elastic package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/gcp directory.
• Run the following command to run tests.

elastic-package test

Related issues

• Closes [GCP Audit Integration] gcp.audit.resource_name not extracted from k8s audit logs #6024

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

Package gcp 👍(4) 💚(0) 💔(2)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
firewall	4032.26	3021.15	-1011.11 (-25.08%)	💔
vpcflow	3952.57	2967.36	-985.21 (-24.93%)	💔

To see the full report comment with /test benchmark fullreport

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 9a9ef92

cc @moxarth-rathod

[ishleenk17]

Could we please check why this was excluded before?
Also, in case we are not using this. We might as well not have set orchestrator.type as we were creating and using that field only for this check.

[elastic-vault-github-plugin-prod]

Package gcp - 2.41.1 containing this change is available at https://epr.elastic.co/package/gcp/2.41.1/