[auditd] Missing event.original mapping

The `auditd` integration is missing a mapping for `event.original`. The cause can be attributed to missing validation related to https://github.com/elastic/elastic-package/issues/147.

```
% go run github.com/andrewkroh/go-examples/fields-yml@main packages/auditd/data_stream/log/fields/*.yml \
  | grep event.original
% echo $?
1
```