[8.16](backport #41244) Read journal entries from all boots

[mergify]

Proposed commit message

Some versions of journalctl will only return messages from the current boot when --follow is passed, it will even ignore the cursor or date arguments.

This commit reads messages from all boots by first calling journalctl without the --follow flag, reading all entries and once it successfully exits, then we restart journalctl with the cursor and the --follow flag.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

## Disruptive User Impact

Author's Checklist

• Ensure TestInputParsers from filebeat/input/journald/input_parsers_test.go is not flaky
• Add tests to ensure messages from all boots are read
• Check whether the restart of journalclt can cause problems with multiline parser (see Filebeat's journald input might return an empty message that breaks multiline parser #41331)

How to test this PR locally

1. Run the tests

cd filebeat/input/journald
go test -run=TestInputCanReadAllBoots

2. Run Filebeat reading filebeat/input/journald/testdata/multiple-boots.journal

There must be 6 entries, you can see the plaintext entries by looking at filebeat/input/journald/testdata/multiple-boots.export or by running:

journalctl --file filebeat/input/journald/testdata/multiple-boots.export

3. Fully manual test

1. Run the journald input on a machine (or a journal file) that has got messages from more than one boot
2. Ensure all messages in the journal are correctly ingested.

Related issues

• Closes Journald input only ingests events from the current boot #41083

## Use cases
## Screenshots
## Logs

---

This is an automatic backport of pull request #41244 done by Mergify.

[botelastic]

This pull request doesn't have a Team:<team> label.

[belimawr]

The build seems to be failing because of:

2024-10-23 20:42:19 UTC	helper/socket/ptable_linux.go:23:2: unrecognized import path "kernel.org/pub/linux/libs/security/libcap/cap": https fetch: Get "https://kernel.org/pub/linux/libs/security/libcap/cap?go-get=1": EOF
2024-10-23 20:42:19 UTC	
2024-10-23 20:42:19 UTC	=== Errors
2024-10-23 20:42:19 UTC	helper/socket/ptable_linux.go:23:2: unrecognized import path "kernel.org/pub/linux/libs/security/libcap/cap": https fetch: Get "https://kernel.org/pub/linux/libs/security/libcap/cap?go-get=1": EOF

On my machine I can compile/run the tests without problems... I'll just re-run the tests