Cherry-pick #22097 to 7.x: [filebeat][suricata] Change x509 mappings from file. to tls.server.

[marc-gr]

Cherry-pick of PR #22097 to 7.x branch. Original message:

What does this PR do?

Changes x509 mappings from being under file to tls.server

Why is it important?

After some conversations with ecs team, we agreed it makes more sense to have them under tls.server in this case.

Checklist

- [ ] My code follows the style guidelines of this project
- [ ] I have commented my code, particularly in hard-to-understand areas
- [ ] I have made corresponding changes to the documentation
- [ ] I have made corresponding change to the default configuration files

• I have added tests that prove my fix is effective or that my feature works
  - [ ] I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Build Cause: [Pull request #22124 opened]

• Start Time: 2020-10-23T07:15:30.528+0000

• Duration: 77 min 31 sec

Test stats 🧪

Test	Results
Failed	0
Passed	1947
Skipped	259
Total	2206