Update CNVM findings schema

[uri-weisman]

Summary of your changes

1. class -> vulnerability.class
2. target -> package.path
3. type -> package.type
4. Move vulnerability.package to be directly under package as defined in the technical index and in ECS.
5. Upgrade elastic-package binary to the latest.

Related Issues

• Fixes: Move non-ECS fields from root level event #897

Checklist

• I have added tests that prove my fix is effective or that my feature works
• I have added the necessary README/documentation (if appropriate)

[mergify]

This pull request does not have a backport label. Could you fix it @uri-weisman? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-v./d./d./d is the label to automatically backport to the 8./d branch. /d is the digit
  NOTE: backport-skip has been added to this pull request.

[github-actions]

Cloudbeat CI 🤖

Allure Report: http://csp-allure-reports.s3.amazonaws.com/allure_reports/cloudbeat/prs/912/index.html

[amirbenun]

1. Do we want to backport?
2. In #897 there is also cluster_id do we want to change it on a different PR?

[oren-zohar]

@kfirpeled do we want to backport this?

[uri-weisman]

2. In Move non-ECS fields from root level event #897 there is also cluster_id do we want to change it on a different PR?

@amirbenun - Feels like it does not relate to the CNVM flow as we don't send this field.
I'll open a follow-up task for removing the cluster_id field (it has already an alternative - orchestrator.cluster.id), it will be a bit more complicated as it is a breaking change.

[kfirpeled]

@kfirpeled do we want to backport this?

Yes, looking at the current implementation:

• having package both in the root level and under vulnerability
• moving type, target and class from the root level

We agree to backport that to 8.8

cc: @uri-weisman
It also means to fix the mappings in the integration

Out of scope for 8.8

• Removing cluster_id