Define fields to allow representing multiple users in an event.

[webmat]

This PR implements the proposal discussed in #809. In short, we now reuse all user fields in 3 new places, in order to allow capturing more relevant users on a given event:

• user.effective.* is used to capture the effective user in cases of privilege escalation.
• user.target.* is used to capture a distinct user that is affected by an action, like IAM: Alice creates/suspends/deletes Bob.
• user.changes.* is used to capture the changes to an existing user. It's worth pointing out that only the attributes that change for the user are expected to be populated here.

For now this PR simply adds the fields. We don't yet have a good way to have either contextual definitions around field reuse, nor a place to document this via free form text, in the user page. This will come as a later addition.

I'm opening this PR in a straighforward manner, by directly introducing these fields. However I'm thinking this major addition is probably a good candidate to move through the RFC process.

What do you think @epixa @ebeahan @tsg?

Closes #809

[webmat]

Ping all of the fine folks who chimed in on #809: @leehinman @neu5ron @janniten @willemdh @rw-access :-)

[rw-access]

this is great. definitely will need that future issue/PR when we can add notes to explain the nesting, since it's not immediately obvious for many of these

[ebeahan]

+1 for moving these additions through the RFC process 😃

[l0x-c0d3z]

I like the approach. I've been having issues mapping IAM audit logs recently. It also sets a good precedent for stuff like 'process.target.*' (for stuff like cross-process access and code injections).

[webmat]

Closing in favor of #1066 (see also RFC 0007 stage 3 PR #1017)