[github] Allow polymorphic audit ruleset_conditions parameters via subobjects:false

[vatsaldesai93]

Proposed commit message

The audit data stream declares ruleset condition parameters.include / exclude (and repository_ids) as keyword.
That's correct for repository_name / repository_id targets, where GitHub sends strings — but repository_property
targets send objects ({name, source, property_values}) in the same field. An object can't be stored as a keyword,
so the whole document is rejected to the failure store with a document_parsing_exception. No single fixed type
accepts both shapes.

Setting subobjects: false on the parameters / old_parameters objects lets both coexist: strings stay on the
keyword leaf, and objects expand into dotted keyword leaves (parameters.include.name, parameters.include.source,
...). The data stream has no nested fields here, so querying is unaffected.

Trade-off: the explicit include / exclude / repository_ids declarations become an object_type: keyword
catch-all, because the package spec disallows explicit child fields under subobjects: false. The leaves stay
keyword and queryable — they're just mapped dynamically rather than enumerated.

Checklist

• I have reviewed
  tips for building integrations and this pull
  request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to
  guidelines.
• I have verified that any added dashboard complies with Kibana's
  Dashboard good practices (no
  dashboard changes)

How to test this PR locally

A keyword leaf accepts the string form but rejects the object form:

PUT gh-demo
{ "mappings": { "properties": { "params": { "type": "keyword" } } } }

PUT gh-demo/_doc/1
{ "params": ["repo-a", "repo-b"] }

PUT gh-demo/_doc/2
{ "params": { "name": "example", "source": "custom", "property_values": ["true"] } }

Doc 2 fails with document_parsing_exception. With subobjects: false on the enclosing object both variants index
cleanly. Then: elastic-package build and elastic-package test pipeline -C packages/github.

Related issues

• Relates [Github] Audit: declare ruleset_* fields #19073

[elastic-vault-github-plugin-prod]

Reviewers

Buildkite won't run for external contributors automatically; you need to add a comment:

• /test : will kick off a build in Buildkite.

NOTE: https://github.com/elastic/integrations/blob/main/.buildkite/pull-requests.json contains all those details.