[Auditbeat] Socket dataset: Exclude localhost by default

[cwurm]

Adds a new configuration option socket.include_localhost to control if sockets from or to localhost/loopback should be included. It defaults to false to reduce the large amount of data the dataset produces.

I also took the opportunity to clean up, organize, and expand the unit tests - the tests are now TestData, TestOutbound (connects to google.com:80), TestListening, TestLocalhost, and TestLocalhostExcluded.

I also added a section Implementation to the docs with a blurb about how the socket dataset works on Linux.

This is a breaking change since it changes what the socket dataset reports by default. It's worth doing in a minor release IMO since the dataset is quite noisy and the value of local connections is questionable. The current functionality can be restored by setting socket.include_localhost: true.

[elasticmachine]

Pinging @elastic/secops

[andrewkroh]

jenkins test this

[andrewkroh]

There is a test failure at https://travis-ci.org/elastic/beats/jobs/526384523#L748-L762.

[cwurm]

There is a test failure at travis-ci.org/elastic/beats/jobs/526384523#L748-L762.

Thanks, fixed it. The cause was that without local sockets, the integration tests produce no data.

CI is green now, merging.