Add windows event log service restart detection and resubscribe

[jefchien]

Description of the issue

Currently, if the Windows EventLog service crashes and gets restarted, the CloudWatch agent no longer picks up events. This is because the event handle used by the subscription is no longer valid. The CloudWatch agent needs a way to detect that the service has restarted and then re-open the subscription.

Description of changes

Adds a service monitor that uses the golang.org/x/sys/windows/svc/mgr package to periodically (every 10 seconds) detect if the eventlog service's PID has changed. If it has changed, it notifies each of the wineventlog subscriptions to re-subscribe. This prevents the plugin from trying to re-subscribe if the service is down.

License

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Tests

Added a unit test. Deployed build to Windows 2022 instance and manually stopped the EventLog service through the task manager. After restarting the service:

2024-07-22T22:54:52Z D! [windows_event_log] Detected Windows event log service restart
2024-07-22T22:54:52Z D! [wineventlog] Re-subscribed to Security
2024-07-22T22:54:52Z D! [wineventlog] Re-subscribed to Application

Requirements

Before commit the code, please do the following steps.

1. Run make fmt and make fmt-sh
2. Run make lint

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 64.65%. Comparing base (96d4763) to head (6fd94b2).
Report is 584 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1259      +/-   ##
==========================================
+ Coverage   57.58%   64.65%   +7.06%     
==========================================
  Files         370      465      +95     
  Lines       17548    22881    +5333     
==========================================
+ Hits        10105    14793    +4688     
- Misses       6848     7385     +537     
- Partials      595      703     +108     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.