Consolidate documentation around fingerprint file identity in the Filestream output

[rdner]

Describe the enhancement:

We switched to the fingerprint-based file identity in Filestream by default (see #40197) we now should improve the documentation around it.

Prior the new default, due to the nature of the implementation, it required to set multiple parameters in 2 separate config sections to enable the fingerprint-based file identity:

• prospector.scanner.fingerprint https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-filestream.html#filebeat-input-filestream-scan-fingerprint
• file_identity https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-filestream.html#_file_identity_2

Currently the documentation is scattered between these 2 sections, which is far from ideal.

A consolidated documentation section would be a better solution, it should cover:

• Reasons behind using the fingerprint-based file identity instead of other options (there was a blog post about it that can be used for the docs https://www.elastic.co/blog/introducing-filestream-fingerprint-mode)
• Edge cases that might confuse users new to the concept:
  • The default length of the fingerprint header is 1024 bytes and the default offset is 0 – both are configurable
  • Changing any of these two settings leads to changing of file IDs which leads to re-ingesting all files causing duplicates
  • Decreasing the length makes the identity less reliable (more likelihood of a collision)
  • Any file under the offset+length in size will not be ingested until it grows larger in size to cross this threshold.
  • For users who are planning to ingest files < 1KB in size the default configuration would not work anymore

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)