o365: tolerate string JSON encodings of objects in Actions field (#14944)

O365 may send the objects in the Actions field as their JSON encoding, so conditionally parse elements of the list when they are strings. This requires working around the absence of an 'if' for iteration processors in the foreach processor and the absence of a JSON parser in Painless. If the array is mixed, the ordering of entries will be altered.

Author: efd6

packages/o365/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.24.0"
+ changes:
+ - description: Tolerate string elements in Actions list.
+ type: enhancement
+ link: https://github.com/elastic/integrations/pull/14944
 - version: "2.23.0"
  changes:
  - description: Reduce repeated work and memory allocations during agent processing.