The basic GeoIP plugin provides this information when available, we should add it to ECS. Note that I think there's more to add in the `geo` field set, but this one is straightforward.