Support for wildcards and override option for dot_expander processor

[felixbarny]

Adds the ability to override conflicting properties instead of converting them to an array.
Also, adds support for specifying a wildcard * to apply the dot extension to every property.

Background: This is important for creating a parsing pipeline for ECS JSON logs.
Due to human readability and the way some logging frameworks work (based on adding chars to a stream rather than maintaining a dictionary for JSON objects), ECS loggers use dotted field names and nested objects interchangeably (foo.bar: baz, foo: { bar: baz }). As not all fields are known upfront, we need to dedot all fields.
Good news is that we don't have to do that recursively, as a path is either fully dotted or fully nested. I.e. we don't have to consider cases like foo: { bar.baz: qux }.

The override property is important for this use case: data_stream: { dataset: foo }, data_stream.dataset: bar. Expanding data_stream would lead to data_stream: { dataset: [foo, bar] } but this is not expected to be an array field. Instead, the dotted field should always override the nested field.

[elasticmachine]

Pinging @elastic/es-core-features (Team:Core/Features)

[jakelandis]

Does this address this issue ? #36950

[felixbarny]

Yep, it does.

[felixbarny]

@danhermann I have implemented your suggestions. Could you have another look?

[danhermann]

@elasticmachine run elasticsearch-ci/docs

[danhermann]

Some minor suggestions below. No need for another round of review if they can be incorporated without issue.

[danhermann]

Thanks, LGTM. 👍

[elasticsearchmachine]

💚 Backport successful

Status	Branch	Result
✅	7.x