Add elastic-agent-security packaging variant with security-only build support

[blakerouse]

What does this PR do?

Introduces a new elastic-agent-security distribution variant. A slim packaging of Elastic Agent that bundles only the components needed for security use cases: endpoint-security and a stripped-down elastic-otel-collector (filebeat with filestream/log/syslog only, metricbeat with linux/system/windows modules only, and osquerybeat).

Why is it important?

The security variant produces significantly smaller artifacts (~112 MB otel-collector vs ~376 MB standard, ~34 MB agent vs ~65 MB standard), reducing image size for security-focused deployments that only need endpoint protection and basic log/metric collection.

Checklist

• I have read and understood the pull request guidelines of this project.
• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• [ ] I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• [ ] I have added an entry in ./changelog/fragments using the changelog tool (No changelog at the moment, as I don't know if we will release this).
• [ ] I have added an integration test or an E2E test

Disruptive User Impact

None. The VARIANTS env var defaults to basic, preserving all current build and packaging behavior. The new security variant is opt-in.

How to test this PR locally

Build both variants:

VARIANTS=basic,security mage package

Build security variant only:

VARIANTS=security mage package

Verify the security otel-collector is significantly smaller than the standard one, and that the agent binary built with -tags securityonly rejects unsupported input types via component.Err when a policy containing them is applied.

Unit tests for the input enforcement logic: go test ./pkg/component/... -run TestSecurityOnlyVariantUnsupportedBeatError -v

[infra-vault-gh-plugin-prod]

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)

[infra-vault-gh-plugin-prod]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: 79abfa3

Failed CI Steps

• linux:amd64:tier1:sudo:fleet

History

• 💔 Build #45625 failed d79e86d
• 💔 Build #45613 failed e7d0d70

cc @blakerouse