[Osquerybeat] [Bugfix] Encoding timestamps

[brian-mckinney]

Proposed commit message

When encoding zero timestamps to a unix epoch format, the result is incorrect if EncodingFlagUseNumbersZeroValues is set. This happens, because time.Unix() uses the go zero time (0001-01-01 00:00:00 +0000 UTC) when calculating the epoch timestamp. Which results in a very large negative number (not a valid unix epoch from osquery's perspective)

I took the opportunity to refactor the timestamp encoding to reduce code reuse. I also fixed a bug in the switch statement in which the kitchen format was not being parsed correctly.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works. Where relevant, I have used the stresstest.sh script to run them under stress conditions and race detector to verify their stability.
• I have added an entry in ./changelog/fragments using the changelog tool.

Disruptive User Impact

Author's Checklist

• [ ]

How to test this PR locally

Related issues

Use cases

Screenshots

Logs

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

[elasticmachine]

Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform)