Osquerybeat: Fix restart flags after previously bad config

[aleksmaus]

What does this PR do?

Fixes the oquery flags update defect.

The issue is reproducible with the following steps:

1. Apply bad config flag

{
  "options": {
    "disable_events": false,
    "enable_file_events": true
    "enable_ntfs_publisher": true
  }
 }

2. Osquery stops with error

[elastic_agent.osquerybeat][error] process exited with error: ERROR: unknown command line flag 'enable_ntfs_publisher': exit status 1

3. Remove enable_ntfs_publisher option.
4. The osquery uses old flags to (visible in debug log) and fails.

Expected result, the new flags are used and osquery becomes usable (can issue ad-hoc queries for example)

This is a minimal change to fix this for 7.16 next RC is on 11/10.

If I get time before 11/10, will revisit the osquery runner one more time.
If not will leave it for 8.0 to improve.

Why is it important?

Fixes the osquery configuration options update defect in 7.16

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas

[james-elastic]

good catch

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2021-11-04T21:13:47.231+0000

• Duration: 66 min 37 sec

• Commit: 52e485d

Test stats 🧪

Test	Results
Failed	0
Passed	4027
Skipped	0
Total	4027

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

• /package : Generate the packages and run the E2E tests.

• /beats-tester : Run the installation tests with beats-tester.