[Filebeat][Crowdstrike] Adding fix to ingest pipeline for command line array handling

[P1llus]

Proposed commit message

Since Arrays.asList returns a fixed size array, while args should usually never be an emptry string, on the occasions that it is, it will produce an error because removeIf tries to modify the array, this PR returns a new ArrayList instead:

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Logs

Error example:

us"=>400, "error"=>{"type"=>"script_exception", "reason"=>"runtime error", "script_stack"=>["java.base/java.util.Iterato
r.remove(Iterator.java:102)", "java.base/java.util.Collection.removeIf(Collection.java:577)", "arg -> arg == \"\");\n\n
", "^---- HERE"], "script"=>"def commandLine = ctx?.crowdstrike?.event?.CommandLine; ...", "lang"=>"painless", "posit
ion"=>{"offset"=>220, "start"=>220, "end"=>244}, "caused_by"=>{"type"=>"unsupported_operation_exception", "reason"=>"remove"}}}}

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-09-05T11:28:47.623+0000

• Duration: 73 min 53 sec

Test stats 🧪

Test	Results
Failed	0
Passed	3158
Skipped	176
Total	3334

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

• /package : Generate the packages and run the E2E tests.

• /beats-tester : Run the installation tests with beats-tester.

• run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

[marc-gr]

LGTM but is it possible to add a test case?

[ShourieG]

Lgtm

[P1llus]

Added a triple whitespace to a command line test sample together with an argument, was the only way to add an empty string to test with.