google_workspace,jamf_protect,ti_mandiant: add "preserve_original_event" tag to documents with event.kind set to "pipeline_error"

[efd6]

Proposed commit message

This manually replays the changes in #12046.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

Related issues

• For security-service-integrations: retain event.original value upon pipeline errors #12067

Screenshots

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 6511315

cc @efd6

[elastic-sonarqube]

Quality Gate failed

Failed conditions
3.8% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elastic-vault-github-plugin-prod]

Package google_workspace - 2.27.0 containing this change is available at https://epr.elastic.co/package/google_workspace/2.27.0/

[elastic-vault-github-plugin-prod]

Package jamf_protect - 2.8.0 containing this change is available at https://epr.elastic.co/package/jamf_protect/2.8.0/

[elastic-vault-github-plugin-prod]

Package ti_mandiant_advantage - 1.7.0 containing this change is available at https://epr.elastic.co/package/ti_mandiant_advantage/1.7.0/