Fix uri_parts processor behaviour for missing extensions - #105689

Ignore the existence of an invalid  `url.extension` field. Stack versions < 8.14 had a
bug that populated the field with bad data. After a package uses a minimum stack version
of 8.14.0 then this addition to `dynamic_fields` can be removed.

This fixes errors like this which occur under v8.14.0

    test case failed: Expected results are different from actual ones: --- want
    +++ got
    @@ -1797,7 +1797,6 @@
                     "preserve_duplicate_custom_fields"
                 ],
                 "url": {
    -                "extension": "com/page",
                     "original": "www.example.com/page",
                     "path": "www.example.com/page"
                 }

Relates: elastic/elasticsearch#105689

Extension to #9623

Ignore the existence of an invalid url.extension field. Stack versions < 8.14
had a bug that populated the field with bad data. After a package uses a minimum
stack version of 8.14.0 then this addition to dynamic_fields can be removed.

This fixes errors like this which occur under v8.14.0+

+++ got
@@ -1797,7 +1797,6 @@
                 "preserve_duplicate_custom_fields"
             ],
             "url": {
-                "extension": "com/page",
                 "original": "www.example.com/page",
                 "path": "www.example.com/page"
             }

Relates: elastic/elasticsearch#105689

Extension to elastic#9623

Ignore the existence of an invalid url.extension field. Stack versions < 8.14
had a bug that populated the field with bad data. After a package uses a minimum
stack version of 8.14.0 then this addition to dynamic_fields can be removed.

This fixes errors like this which occur under v8.14.0+

+++ got
@@ -1797,7 +1797,6 @@
                 "preserve_duplicate_custom_fields"
             ],
             "url": {
-                "extension": "com/page",
                 "original": "www.example.com/page",
                 "path": "www.example.com/page"
             }

Relates: elastic/elasticsearch#105689

Extension to elastic#9623

Ignore the existence of an invalid url.extension field. Stack versions < 8.14
had a bug that populated the field with bad data. After a package uses a minimum
stack version of 8.14.0 then this addition to dynamic_fields can be removed.

This fixes errors like this which occur under v8.14.0+

+++ got
@@ -1797,7 +1797,6 @@
                 "preserve_duplicate_custom_fields"
             ],
             "url": {
-                "extension": "com/page",
                 "original": "www.example.com/page",
                 "path": "www.example.com/page"
             }

Relates: elastic/elasticsearch#105689

Everything m365_defender and microsoft_defender_endpoint were losing, plus
the url extension that went with it.

Three of the four are new Painless shapes, all read off the script rather
than hard-coded. `process.name` is gathered from the executables of
`process.command_line` -- first token, last `/` segment, quotes stripped --
and written as a SCALAR when one name survives and a list otherwise, which
is the vendor's own HashSet ending. DNS header flags are the keys of a
literal list whose value in the map is the string "true", in the list's
order rather than the map's. And DNS answers zip with their TTLs into a
list of objects, carrying the script's cast to long and its own error
message when the two lists disagree in length.

The fourth is the sentinel removal. The defender pipelines wrap it in a
recursive drop-empty and run `drop(ctx)` after it, so the removal claimed
the script and the sweep that clears what it just emptied never ran -- an
evidence list the vendor ships empty came out as a stray `[]`.

url.extension comes from the segment after the LAST `/`, and a path with no
slash at all gets none. That is elastic/elasticsearch#105689, which we had
half of: the dotted directory was already handled, the bare hostname was
not, so `subdomain.domain.tld` came out with an extension of "tld".

zscaler_zia 92 -> 93 of 93, m365_defender 100 -> 106, defender endpoint
20 -> 22, no source regressed. Corpus 4,807/4,850 events (99%) from 4,798,
fields 100.0%. Baseline raised, suite green, clippy clean.

Everything m365_defender and microsoft_defender_endpoint were losing, plus
the url extension that went with it.

Three of the four are new Painless shapes, all read off the script rather
than hard-coded. `process.name` is gathered from the executables of
`process.command_line` -- first token, last `/` segment, quotes stripped --
and written as a SCALAR when one name survives and a list otherwise, which
is the vendor's own HashSet ending. DNS header flags are the keys of a
literal list whose value in the map is the string "true", in the list's
order rather than the map's. And DNS answers zip with their TTLs into a
list of objects, carrying the script's cast to long and its own error
message when the two lists disagree in length.

The fourth is the sentinel removal. The defender pipelines wrap it in a
recursive drop-empty and run `drop(ctx)` after it, so the removal claimed
the script and the sweep that clears what it just emptied never ran -- an
evidence list the vendor ships empty came out as a stray `[]`.

url.extension comes from the segment after the LAST `/`, and a path with no
slash at all gets none. That is elastic/elasticsearch#105689, which we had
half of: the dotted directory was already handled, the bare hostname was
not, so `subdomain.domain.tld` came out with an extension of "tld".

zscaler_zia 92 -> 93 of 93, m365_defender 100 -> 106, defender endpoint
20 -> 22, no source regressed. Corpus 4,807/4,850 events (99%) from 4,798,
fields 100.0%. Baseline raised, suite green, clippy clean.