x-pack/filebeat/input/cel: misc refactoring

[chrisberkhout]

The CEL input has grown in complexity over time and is due to for some refactoring attention.

This is particularly evident during the present work to add OTel tracing (#48440), which uses separate spans for separate parts of processing and needs separate context and loggers for each, which is more cumbersome in one big function than separate functions with narrower responsibilities.

Here's cyclomatic complexity over time of the (input).run function (479 lines):

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[efd6]

What is the the proposed direction for this work?

[chrisberkhout]

Start by shrinking the (input).run function by extraction other functions for the periodic loop, an individual evaluation and the publishing loop.
Maybe add a type and functions for managing CEL state map.
Maybe move some things out to other files.