Added new hash fields

[dstepanic]

• Have you signed the contributor license agreement? yes
• Have you followed the contributor guidelines? yes
• For proposing substantial changes or additions to the schema, have you reviewed the RFC process? yes
• If submitting code/script changes, have you verified all tests pass locally using make test? no script changes, only schema
• If submitting schema/fields updates, have you generated new artifacts by running make and committed those changes? yes
• Is your pull request against main? Unless there is a good reason otherwise, we prefer pull requests against main and will backport as needed. yes
• Have you added an entry to the CHANGELOG.next.md? yes

Reference: #1620

[kgeller]

LGTM!

[ebeahan]

For the hash.* field set, ECS lists this guidance:

Note that this fieldset is used for common hashes that may be computed over a range of generic bytes. Entity-specific hashes such as ja3 or imphash are placed in the fieldsets to which they relate (tls and pe, respectively).

I'm not very familiar with either pehash or tlsh; are either of those entity-specific hash types?

[dstepanic]

Yeh, so TLSH is a fuzzy matching hash used for similarity comparisons and is similar to ssdeep which is currently in the hash.* field set. But for pehash, it sounds to me like it fits more of the entity-specific hash type. I will go and move that under the pe schema.

[ebeahan]

LGTM