[sentinel_one] Split domain-qualified user.name values into user.domain

[chrisberkhout]

Proposed commit message

[sentinel_one] Split domain-qualified `user.name` values into `user.domain` (#)

According to the ECS usage guidance[1]:

> When a system provides a composite value for the user name (e.g.
> DOMAINNAME\username), capture the domain name in `user.domain` and the
> user name (without the domain) in `user.name`.

[1]: https://www.elastic.co/docs/reference/ecs/ecs-user-usage#ecs-user-identifiers

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: b6be142

cc @chrisberkhout

[ShourieG]

LGTM

[elastic-vault-github-plugin-prod]

Package sentinel_one - 2.0.1 containing this change is available at https://epr.elastic.co/package/sentinel_one/2.0.1/