Fix ECS source.ip field in users

[fearful-symmetry]

What does this PR do?

This fixes a straggling keyword mapping of source.ip in the users datastream, reported here: elastic/kibana#73797

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.

How to test this PR locally

• Pull down PR, build and run elastic-stack with agent on linux, and linux/users enabled.
• You should be able to reproduce this on a linux server with remote users logged in.
• Make sure there's no mapping conflicts.

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Build Cause: Pull request #882 updated

• Start Time: 2021-04-06T16:44:00.295+0000

• Duration: 45 min 26 sec

• Commit: 276772c

Test stats 🧪

Test	Results
Failed	0
Passed	1923
Skipped	3
Total	1926

Trends 🧪