[libbeat] Move etw reader out of x-pack to Apache licensed code

[marc-gr]

Proposed commit message

Relicense ETW reader to Apache

[elasticmachine]

Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform)

[github-actions]

🤖 GitHub comments

Expand to view the GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[v1v]

I've just reviewed the BK changes and LGTM.

[cmacknz]

This looks fine to me, I just want to double check why we are doing this because this is a one way door kind of situation if this is the first time we moved this to Apache. I don't see any issue links for context.

[marc-gr]

This looks fine to me, I just want to double check why we are doing this because this is a one way door kind of situation if this is the first time we moved this to Apache. I don't see any issue links for context.

We need to use this code from an apache auditbeat module. SInce we have no specific reasons to have this in x-pack seems reasonable to move it so it can be used without hassle from apache-licensed code