[ECS] align with ECS observer fieldset

[axw]

APM Server and (potentially other beats acting as an observer) sends several observer fields that are not part of the ECS fieldset definition:

• observer.ephemeral_id
• observer.id

We should propose a change to the ECS observer fieldset, to include these fields.

~In the case of observer.version_major, we would probably want to wait for a resolution on https://github.com/elastic/elasticsearch/issues/48878; rather than continuing to store the major version, we would instead store a semver tuple. See also https://github.com/elastic/ecs/issues/842.~ version_major was removed in https://github.com/elastic/apm-server/pull/7399