swp_all: use triple-brace templating

The mustache templating system used by ingest pipelines has two levels of
escaping available, not escaped (triple stache) and HTML escaped
(double stache) — see man mustache[1] under "tag types: variables". This can
lead to data corruption, particularly in cases where an operating system has
chosen to use a character requiring escaping in its path syntax.

[1]http://mustache.github.io/mustache.5.html

[git-generate]
for f in $(
	(
		for p in $(
			yq 'select(.owner.github == "elastic/sec-windows-platform")|.name' packages/**/manifest.yml \
			| grep -v -- '---'
		); do
			rg -l -g '*.yml' ": ('\{\{[^{][ .a-zA-Z0-9_]*[^}]}}'|\"\{\{[^{][ .a-zA-Z0-9_]*[^}]}}\")" packages/$p
		done
	)|grep "elasticsearch/ingest_pipeline"|sort|uniq
); do
	sed -i -r "s/: (['\"])\{\{([^{][ .a-zA-Z0-9_]*[^}])}}['\"]/: \1{{{\2}}}\1/g" $f
done
for p in $(git diff --name-only HEAD~1|cut -d/ -f1,2|sort|uniq); do
	(
		cd $p
		elastic-package test pipeline -g
		elastic-package changelog add \
			--description "Use triple-brace templating." \
			--type bugfix \
			--next patch \
			--link #11286
	)>/dev/null 2>&1
done

packages/hid_bravura_monitor/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.18.2"
+  changes:
+    - description: Use triple-brace templating.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/11286
 - version: "1.18.1"
   changes:
     - description: Convert error.code to string

packages/hid_bravura_monitor/data_stream/log/elasticsearch/ingest_pipeline/default.yml

@@ -100,7 +100,7 @@ processors:
       field: logdate
       formats:
         - 'yyyy-MM-dd HH:mm:ss.SSS'
-      timezone: '{{event.timezone}}'
+      timezone: '{{{event.timezone}}}'
       description: Convert logdate to @timestamp
   - rename:
       target_field: message

packages/hid_bravura_monitor/manifest.yml

@@ -1,6 +1,6 @@
 name: hid_bravura_monitor
 title: Bravura Monitor
-version: "1.18.1"
+version: "1.18.2"
 categories: ["security", "iam"]
 description: Collect logs from Bravura Security Fabric with Elastic Agent.
 type: integration

packages/mysql_enterprise/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.14.3"
+  changes:
+    - description: Use triple-brace templating.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/11286
 - version: "1.14.2"
   changes:
     - description: Changed owners

packages/mysql_enterprise/data_stream/audit/elasticsearch/ingest_pipeline/default.yml

@@ -161,7 +161,7 @@ processors:
       ignore_missing: true
   - set:
       field: user.name
-      value: "{{server.user.name}}"
+      value: "{{{server.user.name}}}"
       ignore_empty_value: true
       if: "ctx.user?.target != null"
   - append:
@@ -202,27 +202,27 @@ processors:
       ignore_missing: true
   - append:
       field: related.user
-      value: "{{server.user.name}}"
+      value: "{{{server.user.name}}}"
       allow_duplicates: false
       if: ctx?.server?.user?.name != null
   - append:
       field: related.user
-      value: "{{client.user.name}}"
+      value: "{{{client.user.name}}}"
       allow_duplicates: false
       if: ctx?.client?.user?.name != null
   - append:
       field: related.user
-      value: "{{user.target.name}}"
+      value: "{{{user.target.name}}}"
       allow_duplicates: false
       if: ctx?.user?.target?.name != null
   - append:
       field: related.ip
-      value: "{{client.ip}}"
+      value: "{{{client.ip}}}"
       allow_duplicates: false
       if: ctx?.client?.ip != null
   - append:
       field: related.hosts
-      value: "{{client.domain}}"
+      value: "{{{client.domain}}}"
       allow_duplicates: false
       if: ctx?.client?.domain != null
   - date:

packages/mysql_enterprise/manifest.yml

@@ -1,7 +1,7 @@
 format_version: "3.0.0"
 name: mysql_enterprise
 title: "MySQL Enterprise"
-version: "1.14.2"
+version: "1.14.3"
 description: Collect audit logs from MySQL Enterprise with Elastic Agent.
 type: integration
 categories: