in_winevtlog: Support XML query parameter for filtering events

[cosmo0920]

I implemented XML query capability for filtering Windows EventLog.
This is because filter_grep and type converter should be difficult to use when the types of records are unknown.
Instead, we also are able to provide a capability of XML query language to filter events.
EvtSubscribe API which is defined in winevt.h can handle that XML query.
ref: https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtsubscribe

The advantage of the parameter is using in_winevtlog plugin only and not consuming for unneeded events on that plugin.

This feature is also a parity of fluent-plugin-windows-eventlog plugin's event_query parameter: https://github.com/fluent/fluent-plugin-windows-eventlog#configuration

This is related to #7271.

---

Enter [N/A] in the box, if an item is not applicable to your change.

Testing
Before we can approve your change; please submit the following in a comment:

• Example configuration file for the change

To filter an event which has EventID 1040 within in_winevtlog plugin, we can use the following query in Event_Query parameter:

[SERVICE]
    Log_Level   debug
[INPUT]
    Name        winevtlog
    channels    Application
    Use_ANSI    True
    Event_Query Event/System[EventID!=1040]

[OUTPUT]
    Name stdout

• Debug log output from testing the change

• Attached Valgrind output that shows no leaks or memory corruption was found

If this is a change to packaging of containers or native binaries then please confirm it works for all targets.

• Run local packaging test showing all targets (including any new ones) build.
• Set ok-package-test label to test for all targets (requires maintainer to do).

Documentation

• Documentation required for this feature

fluent/fluent-bit-docs#1179

Backporting

• Backport to latest stable release.

---

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

[edsiper]

cc: @lecaros docs