[WIP] Add fields for Linux mprotect events

[Aegrah]

Summary

Add queryable mappings and Linux process-event documentation for:

• process.Ext.mprotect.addr
• process.Ext.mprotect.len
• process.Ext.mprotect.prot
• process.Ext.mprotect.prot_flags

The docs describe the final contract: only successful calls requesting executable protection (X, RX, WX, or RWX) are emitted, and collection requires advanced.events.hidden.emit_diagnostic_fields.

Issue: https://github.com/elastic/endpoint-dev/issues/20408

Workflow and proof

The contract workflow regenerated the package and combined schemas, built Endpoint, ran focused unit/EAF tests, deployed the custom integration through Fleet, and asserted Elasticsearch output.

• Preflight 20260722T124741Z-mprotect-preflight: PASS
• Fleet acceptance 20260722T142745Z-mprotect on Stack/Agent/Endpoint 9.4.2: PASS
• make clean all, generated handoff, and schema freshness: PASS
• Realistic workstation qualification 20260722T103000Z-mprotect-realistic-smoke: PASS

3,708 Endpoint documents / 4,737 action values
exec: 523 (11.04%); mprotect: 6 (0.13%, 0.16% document coverage)
mprotect executables: /usr/bin/node 5; chromium headless_shell 1
masks: RWX 6 (100%)

Companion PRs

• Quark: Add mprotect syscall events quark#367
• endpoint-dev: https://github.com/elastic/endpoint-dev/pull/21136