Add RPM packaging

[tsg]

This adds support for programmatically reading the list of RPM packages. The previous version was using exec (called the rpm binary), but we'd like to keep Auditbeat exec free, because execs are currently blocked by seccomp, as a security feature.

Using the model from Journalbeat, the new code uses dlopen get the relevant C functions and calls them using CGo. This means that librpm is not a hard dependency, but only for when this functionality is needed.

Ready for reviews, but there's a couple of things left to do:

• Figure out cross-compiling during mage package (we need librpm-devel).
• Figure out how to run the test in a Redhat enviromnent. There is a unit test that checks that the RPM output is the same as the one from exec-ing the rpm commmand, but that test is skipped on on non-Redhat systems. Currently, we run all tests in a Debian based docker image.

Part of #8725.

[elasticmachine]

Pinging @elastic/secops

[andrewkroh]

This handle is never Closed().

[tsg]

Yes, it's not, but I cannot just add a defer because I cannot call the functions from it, it panics. It's currently a singleton so it exists only once per process. Putting it in the Metricset structure would be possible, but requires a bigger refactoring of the whole module. Let me know if you think it's worth doing it anyway.

[andrewkroh]

That should be find then. I guess I missed the if cFun == nil check surrounding its usage.

[andrewkroh]

It should be good to merge after adding that platform filter to the magefile.go.

[andrewkroh]

That should be find then. I guess I missed the if cFun == nil check surrounding its usage.

[andrewkroh]

A few lines up in init() add a filter to prevent mage package from attempting to build these targets.

mage.Platforms = mage.Platforms.Filter("!linux/ppc64 !linux/mips64")

This is similar to what journalbeat has but with the linux selector.

beats/journalbeat/magefile.go

Lines 35 to 38 in 1411852

	func init() {
	mage.BeatDescription = "Journalbeat ships systemd journal entries to Elasticsearch or Logstash."
	mage.Platforms = mage.Platforms.Filter("linux !linux/ppc64 !linux/mips64")

[cwurm]

@tsg Package dataset is merged into master with #10225 - can you rebase this?

[tsg]

Superseded by #10429