crowdstrike.fdr: Increase field limits in FDR data-streams to avoid unindexed ECS fields

[kcreddy]

Proposed commit message

Crowdstrike FDR data stream can collect more than 1000 fields
and the data stream explicitly defines more than 500 fields.
In such cases, the total_fields.limit is automatically updated to 
10000[1] from the default 1000. 
Having such dynamic resizing could be detrimental when some of 
these explicitly mapped fields are later removed and the limit goes 
back to 1000. If it goes back to 1000, then it could end up not 
indexing all fields, even the ECS fields.

This PR sets the field limit to 2000 to facilitate 
indexing of all fields, especially ECS.

Ref: 
- [1] https://www.elastic.co/guide/en/integrations-developer/current/general-guidelines.html#_field_limits

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

Current (1.54.0) version:
GET .ds-logs-crowdstrike.fdr-default-2025.03.11-000001/_settings

{
  ".ds-logs-crowdstrike.fdr-default-2025.03.11-000001": {
    "settings": {
      "index": {
        "mapping": {
          "total_fields": {
            "limit": "10000",
            "ignore_dynamic_beyond_limit": "true"
          },
          "ignore_malformed": "true"
        },

With new PR change
GET .ds-logs-crowdstrike.fdr-default-2025.03.11-000001/_settings

{
  ".ds-logs-crowdstrike.fdr-default-2025.03.11-000001": {
    "settings": {
      "index": {
        "mapping": {
          "total_fields": {
            "limit": "2000",
            "ignore_dynamic_beyond_limit": "true"
          },
          "ignore_malformed": "true"
        },

Related issues

Screenshots

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: c2d0eca

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[efd6]

Behaviour change confirmed.

[elastic-vault-github-plugin-prod]

Package crowdstrike - 1.55.0 containing this change is available at https://epr.elastic.co/package/crowdstrike/1.55.0/