Add email.mailfrom.address to email fields

[mbudge]

There is an ecs field for email.from.address which is the From field in the email header.

The mailfrom field in the smtp header is a field useful for detecting email spoofing.

Please add email.mailfrom.address to ecs. Also update the mimecast integration to extract the headerFrom field from the inbound Acc logs.

[qcorporation]

@mjwolf investigate if mailfrom is a standard smtp header.
find out all integration that can normalize to this field if we were to add this into ECS

[mjwolf]

MAIL FROM and RCPT TO are both fields of SMTP envelope from RFC 5321.

It's currently used in these integrations zeek, proofpoint_on_demand, cisco_secure_email_gateway, m365_defender, sublime_security.

Given this is a standard SMTP field, and used by multiple observability products, I think it makes sense to add this to ECS