in_systemd: Process enumerated data as cfl_kvlist(s) at first

[cosmo0920]

This is because systemctl's -o json-pretty or -o json converts duplicated keys' values as array(s).
To avoid generating the duplicated key(s) does not resolve this issue. Instead, we need to store as cfl_kvlist at first to detect duplicated keys on enumerated data in journal storage.
Then, we also need to generate as msgpack's array format when the duplicated key(s) were detected and translated as array format when storing as cfl_kvlist(s).

Closes #501.

---

Enter [N/A] in the box, if an item is not applicable to your change.

Testing
Before we can approve your change; please submit the following in a comment:

• Example configuration file for the change

$ bin/fluent-bit -i systemd -p read_from_tail=on -o stdout -v

Send SystemD logs

$ echo -e 'MESSAGE=test native message with multiple values\nKEY=value1\nKEY=value4\nKEY2=value2\nKEY=another\nKEY2=value2\nKEY2=value5\nKEY3=howdy\nKEY3=prettygood\nKEY2=value10\nKEY3=wow\nKEY2=final_field\n'  | socat - UNIX-SENDTO:/run/systemd/journal/socket

• Debug log output from testing the change

Fluent Bit v3.1.7
* Copyright (C) 2015-2024 The Fluent Bit Authors
* Fluent Bit is a CNCF sub-project under the umbrella of Fluentd
* https://fluentbit.io

______ _                  _    ______ _ _           _____  __  
|  ___| |                | |   | ___ (_) |         |____ |/  | 
| |_  | |_   _  ___ _ __ | |_  | |_/ /_| |_  __   __   / /`| | 
|  _| | | | | |/ _ \ '_ \| __| | ___ \ | __| \ \ / /   \ \ | | 
| |   | | |_| |  __/ | | | |_  | |_/ / | |_   \ V /.___/ /_| |_
\_|   |_|\__,_|\___|_| |_|\__| \____/|_|\__|   \_/ \____(_)___/

[2024/09/02 20:59:18] [ info] Configuration:
[2024/09/02 20:59:18] [ info]  flush time     | 1.000000 seconds
[2024/09/02 20:59:18] [ info]  grace          | 5 seconds
[2024/09/02 20:59:18] [ info]  daemon         | 0
[2024/09/02 20:59:18] [ info] ___________
[2024/09/02 20:59:18] [ info]  inputs:
[2024/09/02 20:59:18] [ info]      systemd
[2024/09/02 20:59:18] [ info] ___________
[2024/09/02 20:59:18] [ info]  filters:
[2024/09/02 20:59:18] [ info] ___________
[2024/09/02 20:59:18] [ info]  outputs:
[2024/09/02 20:59:18] [ info]      stdout.0
[2024/09/02 20:59:18] [ info] ___________
[2024/09/02 20:59:18] [ info]  collectors:
[2024/09/02 20:59:18] [ info] [fluent bit] version=3.1.7, commit=1cc68e1889, pid=2256479
[2024/09/02 20:59:18] [debug] [engine] coroutine stack size: 24576 bytes (24.0K)
[2024/09/02 20:59:18] [ info] [storage] ver=1.1.6, type=memory, sync=normal, checksum=off, max_chunks_up=128
[2024/09/02 20:59:18] [ info] [cmetrics] version=0.9.5
[2024/09/02 20:59:18] [ info] [ctraces ] version=0.5.5
[2024/09/02 20:59:18] [ info] [input:systemd:systemd.0] initializing
[2024/09/02 20:59:18] [ info] [input:systemd:systemd.0] storage_strategy='memory' (memory only)
[2024/09/02 20:59:18] [debug] [systemd:systemd.0] created event channels: read=21 write=22
[2024/09/02 20:59:18] [debug] [input:systemd:systemd.0] jump to the end of journal and skip 0 last entries
[2024/09/02 20:59:18] [debug] [input:systemd:systemd.0] sd_journal library may truncate values to sd_journal_get_data_threshold() bytes: 65536
[2024/09/02 20:59:18] [ info] [output:stdout:stdout.0] worker #0 started
[2024/09/02 20:59:18] [debug] [stdout:stdout.0] created event channels: read=26 write=71
[2024/09/02 20:59:18] [ info] [sp] stream processor started
[2024/09/02 20:59:21] [debug] [task] created task=0x5f4e9d0 id=0 OK
[0] systemd.0: [[1725278360.632045000, {}], {"_TRANSPORT"=>"journal", "_UID"=>"1000", "_GID"=>"1000", "_CAP_EFFECTIVE"=>"0", "_SELINUX_CONTEXT"=>"unconfined
", "_AUDIT_SESSION"=>"3", "_AUDIT_LOGINUID"=>"1000", "_SYSTEMD_OWNER_UID"=>"1000", "_SYSTEMD_UNIT"=>"[email protected]", "_SYSTEMD_SLICE"=>"user-1000.slice", "_MACHINE_ID"=>"8f5838aa79d047acf9ebf69700000005", "_HOSTNAME"=>"cosmo-desktop2", "_SYSTEMD_USER_SLICE"=>"app-org.gnome.Terminal.slice", "MESSAGE"=>"test native message with multiple values", "_COMM"=>"socat", "_EXE"=>"/usr/bin/socat", "_CMDLINE"=>"socat - UNIX-SENDTO:/run/systemd/journal/socket", "KEY"=>["value1", "value4", "another"], "_BOOT_ID"=>"f7b0815315324f3d94fa86281069de5a", "KEY2"=>["value2", "value5", "value10", "final_field"], "KEY3"=>["howdy", "prettygood", "wow"], "_SYSTEMD_CGROUP"=>"/user.slice/user-1000.slice/[email protected]/app.slice/app-org.gnome.Terminal.slice/vte-spawn-1ae93454-9790-450c-8db4-8dd002d7da24.scope", "_SYSTEMD_USER_UNIT"=>"vte-spawn-1ae93454-9790-450c-8db4-8dd002d7da24.scope", "_SYSTEMD_INVOCATION_ID"=>"78b08d4bd43a48a4ba7ad1e78edaf907", "_PID"=>"2256487", "_SOURCE_REALTIME_TIMESTAMP"=>"1725278360631925"}]
[2024/09/02 20:59:21] [debug] [output:stdout:stdout.0] task_id=0 assigned to thread #0
[2024/09/02 20:59:21] [debug] [task] destroy task=0x5f4e9d0 (task_id=0)
[2024/09/02 20:59:21] [debug] [out flush] cb_destroy coro_id=0
^C[2024/09/02 20:59:31] [engine] caught signal (SIGINT)
[2024/09/02 20:59:31] [ warn] [engine] service will shutdown in max 5 seconds
[2024/09/02 20:59:31] [ info] [input] pausing systemd.0
[2024/09/02 20:59:32] [ info] [engine] service has stopped (0 pending tasks)
[2024/09/02 20:59:32] [ info] [input] pausing systemd.0
[2024/09/02 20:59:32] [ info] [output:stdout:stdout.0] thread worker #0 stopping...
[2024/09/02 20:59:32] [ info] [output:stdout:stdout.0] thread worker #0 stopped

• Attached Valgrind output that shows no leaks or memory corruption was found

==2256479== 
==2256479== HEAP SUMMARY:
==2256479==     in use at exit: 0 bytes in 0 blocks
==2256479==   total heap usage: 3,613 allocs, 3,613 frees, 1,312,064 bytes allocated
==2256479== 
==2256479== All heap blocks were freed -- no leaks are possible
==2256479== 
==2256479== For lists of detected and suppressed errors, rerun with: -s
==2256479== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)

If this is a change to packaging of containers or native binaries then please confirm it works for all targets.

• Run local packaging test showing all targets (including any new ones) build.
• Set ok-package-test label to test for all targets (requires maintainer to do).

Documentation

• Documentation required for this feature

Backporting

• Backport to latest stable release.

---

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.