Update GitHub Data Model to display admin-add events instead of UNKNOWN_ROLE

[egibs]

Background

GitHub's audit logs don't explicitly define an admin role and instead offers a few events that indicate admin permissions were assigned to a user (or at least when an attempt is made).

Originally, the data model only accounted for team.promote_maintainer, but there are two additional events that indicate admin permissions are being assigned or attempting to be assigned (at least at an organization level).

This PR adds the additional events and returns the event name rather than <UNKNOWN_ROLE> when these events are encountered. Worst case, the data model falls back to <UNKNOWN_ADMIN_ROLE> .

Changes

• Adds additional admin events to the GitHub Data Model
• Return the event name when possible

Testing

• make fmt; make lint; make test

[PASS] Github - User Promoted
        [PASS] [rule] true
        [PASS] [title] GitHub.Audit: [cat] assigned admin privileges [team.promote_maintainer] to [bob]
        [PASS] [dedup] GitHub.Audit: [cat] assigned admin privileges [team.promote_maintainer] to [bob]
        [PASS] [alertContext] {"ips": [], "actor": "cat", "user": "bob"}
[PASS] Github - Admin Added
        [PASS] [rule] true
        [PASS] [title] GitHub.Audit: [cat] assigned admin privileges [business.add_admin] to [bob]
        [PASS] [dedup] GitHub.Audit: [cat] assigned admin privileges [business.add_admin] to [bob]
        [PASS] [alertContext] {"ips": [], "actor": "cat", "user": "bob"}
[PASS] Github - Admin Invited
        [PASS] [rule] true
        [PASS] [title] GitHub.Audit: [cat] assigned admin privileges [business.invite_admin] to [bob]
        [PASS] [dedup] GitHub.Audit: [cat] assigned admin privileges [business.invite_admin] to [bob]
        [PASS] [alertContext] {"ips": [], "actor": "cat", "user": "bob"}
[PASS] Github - Unknown Admin Role
        [PASS] [rule] false

[arielkr256]

Nice improvement!