libbeat: add 'eventfd2' to default seccomp policy

[AndersonQ]

I'll add the known issue in another PR as it affects other versions

Proposed commit message

libbeat: add 'eventfd2' to default seccomp policy

Since Go introduced https://go.dev/cl/560615 it uses `eventfd2`, which was not part of our default seccomp policy. Due to the `google.golang.org/protobuf` dependency `eventfd2` during its initialisation, before our seccomp policy be applied, thus it worked.
However once filebeat is reexeced, for example, due to a CA change, the seccomp policy would be in place and prevent `eventfd2` call, crashing filebeat.

This change adds `eventfd2` to the default seccomp policy

Checklist

• My code follows the style guidelines of this project
• [ ] I have commented my code, particularly in hard-to-understand areas
• [ ] I have made corresponding changes to the documentation
• [ ] I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Disruptive User Impact

• n/a

How to test this PR locally

follow the steps outlined in the bug on how to reproduce the issue:

• Filebeat config option restart_on_cert_change consistently causes crash #46333

Related issues

• Closes Filebeat config option restart_on_cert_change consistently causes crash #46333

Use cases

• anyone using CA reload
• anyone using any feature causing any beat to re-exec

[github-actions]

🤖 GitHub comments

Expand to view the GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

[mergify]

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @AndersonQ? 🙏.
For such, you'll need to label your PR with:

• The upcoming major version of the Elastic Stack
• The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit
• backport-active-all is the label that automatically backports to all active branches.
• backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
• backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b 46333-fix-seccomp-default-policy upstream/46333-fix-seccomp-default-policy
git merge upstream/main
git push upstream 46333-fix-seccomp-default-policy