event reason?

Regarding

`event.category / event.action / event.outcome`

I think we also need `event.reason`

For example:

```
- event.category: user-management
- event.action: user-password-change
- event.outcome: failure
- event.reason: password policy violation
```
