Use upstream fsnotify/fsevents instead of Elastic fork

[cmacknz]

• Closes Replace use of forked https://github.com/elastic/fsevents with upstream https://github.com/fsnotify/fsevents #47637

fsevents

• fsnotify/fsevents@ed9a50f matches the fix in elastic/fsevents@92f4352
• fsnotify/fsevents@972ac2c matches the fix in fsnotify/fsevents@972ac2c

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

[mergify]

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @cmacknz? 🙏.
For such, you'll need to label your PR with:

• The upcoming major version of the Elastic Stack
• The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit
• backport-active-all is the label that automatically backports to all active branches.
• backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
• backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

[cmacknz]

It looks like upstream fsnotify has the pieces to do recursive watches but it doesn't expose an API to enable it, to remove the fsnotify fork we need a replacement for the SetRecursive call below and I couldn't spot one:

beats/auditbeat/module/file_integrity/monitor/monitor.go

Line 49 in bac5589

if recursive && watcher.SetRecursive() != nil {

[kruskall]

for reference: fsnotify/fsevents#38 has not been upstreamed but it's present in our fork

[cmacknz]

Closing, as we are unfortunately still missing changes we need upstream per #47637