Fix add_host_metadata host.geo map sharing across events

[github-actions]

Summary

This change fixes add_host_metadata geodata corruption caused by shared map reuse.

When enriching events, host data was cloned before DeepUpdate, but geo data was not. Because DeepUpdate can merge map values by reference, mutating host.geo in one processed event could affect later events.

What changed

• In libbeat/processors/add_host_metadata/add_host_metadata.go, clone cached geo data before merging:
  • event.Fields.DeepUpdate(p.geoData.Clone())
• Added regression test in libbeat/processors/add_host_metadata/add_host_metadata_test.go:
  • TestGeoFieldsAreNotMutatedAcrossEvents
  • Verifies mutating host.geo on one event does not leak to a subsequent event.

Validation

• ✅ go test ./libbeat/processors/add_host_metadata -run TestGeoFieldsAreNotMutatedAcrossEvents
• ⚠️ go test ./libbeat/processors/add_host_metadata fails in this CI container due to existing environment assumptions in pre-existing tests (no valid /etc/(distrib)-release file found), unrelated to this change.

Notes

• Change is intentionally minimal and behavior-preserving, except preventing cross-event host.geo mutation leakage.

• Fixes add_host_metadata Geodata Corruption #49721

Note

🔒 Integrity filtering filtered 1 item

Integrity filtering activated and filtered the following item during workflow execution.
This happens when a tool call accesses a resource that does not meet the required integrity or secrecy level of the workflow.

• issue:add_host_metadata Geodata Corruption #49721 (issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)

---

What is this? | From workflow: Mention in Issue

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[botelastic]

This pull request doesn't have a Team:<team> label.

[mergify]

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @github-actions[bot]? 🙏.
For such, you'll need to label your PR with:

• The upcoming major version of the Elastic Stack
• The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit
• backport-active-all is the label that automatically backports to all active branches.
• backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
• backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.