De-duplicate pipeline steps in system.auth module

[belimawr]

Proposed commit message

See title

Checklist

• My code follows the style guidelines of this project
• [ ] I have commented my code, particularly in hard-to-understand areas
• [ ] I have made corresponding changes to the documentation
• [ ] I have made corresponding change to the default configuration files
• [ ] I have added tests that prove my fix is effective or that my feature works
• [ ] I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Disruptive User Impact

None

## Author's Checklist

How to test this PR locally

Run the system tests

mage buildSystemTestBinary
mage docker:ComposeUp
source $(mage PythonVirtualEnv)/bin/activate
INTEGRATION_TESTS=1 BEAT_STRICT_PERMS=false ES_PASS=testing ES_USER=admin TESTING_FILEBEAT_MODULES=system pytest tests/system/test_modules.py

Related issues

• Spitted from Use journald for system module on Debian 12 #41061
• Closes Reduce ingest pipeline duplication in Filebeat's system module #41226

## Use cases
## Screenshots
## Logs

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[mergify]

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @belimawr? 🙏.
For such, you'll need to label your PR with:

• The upcoming major version of the Elastic Stack
• The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit

[mergify]

backport-8.x has been added to help with the transition to the new branch 8.x.
If you don't need it please use backport-skip label and remove the backport-8.x label.