[Auditbeat] Remove unset user.auid and auditd.session

[andrewkroh]

It has been requested to drop the user.auid field when the value is unset.

Likewise we should follow the same practice for the unset session IDs (auditd.session:unset).

[andrewkroh]

cc: @FrankHassanabad

[adriansr]

Is there a reason to do this only for user.auid and not for all the uid fields?