Refactor Windows Filter flags

[agarakan]

Description of the issue

Move the Windows feature flag detection into the useragent.go component

Description of changes

Removes logic from windows_event_log.go and implements refactored solution in useragent.go including testing

License

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Tests

make lint
make fmt
make fmt-sh
make test

Ran agent on windows instance for e2e test. See userAgent headers with expected fllters

> CWAgent/1.300061.0-4-gc5012da5
  (go1.24.7; windows; amd64)
  ID/65cffef8-5155-46fe-a8f4-6e19b15b0e3c
  inputs:(nop run_as_user windows_event_log)
  outputs:(cloudwatchlogs nop)
  feature:(win_event_filters win_event_ids win_event_levels)
  aws-sdk-go/1.48.6
  (go1.24.7; windows; amd64)
  exec-env/EC2

using CWA config

{
  "agent": {
    "debug": true
  },
  "logs": {
    "logs_collected": {
      "windows_events": {
        "collect_list": [
          {
            "event_name": "System",
            "event_levels": [
              "INFORMATION",
              "WARNING",
              "ERROR"
            ],
            "event_ids": [
              7036,
              7040
            ],
            "filters": [
              {
                "type": "include",
                "expression": "EventID=7036"
              }
            ],
            "log_group_name": "windows-system-events",
            "log_stream_name": "{instance_id}",
            "retention_in_days": 1
          },
          {
            "event_name": "Application",
            "event_levels": [
              "ERROR",
              "CRITICAL"
            ],
            "event_format": "xml",
            "log_group_name": "windows-app-events",
            "log_stream_name": "{instance_id}",
            "retention_in_days": 1
          }
        ]
      }
    }
  }
}


Feature Flag Triggers:
• 🔹 flagWindowsEventIDs → "event_ids": [7036, 7040]
• 🔹 flagWindowsEventFilters →
"filters": [{"type": "include", "expression": "EventID=7036"}]
• 🔹 flagWindowsEventLevels →
"event_levels": ["INFORMATION", "WARNING", "ERROR"]

See CloudTrail command to retrieve UserAgent from the CW event header once CWA started with above config

ws cloudtrail lookup-events --region us-west-2 \
  --lookup-attributes AttributeKey=Username,AttributeValue=i-redacted \
  --max-results 20 \
  --query 'Events[?EventSource==`logs.amazonaws.com`] | [0].CloudTrailEvent' \
  --output text | jq -r '.userAgent'

Requirements

Before commiting your code, please do the following steps.

1. Run make fmt and make fmt-sh
2. Run make lint

---

Integration Tests

To run integration tests against this PR, add the ready for testing label.

[TravisStark]

Nit: details are out of date from the latest changes regarding change locations