[system/security] - Drop empty process.args token from trailing whitespace - #20907

…tespace (#20911)

windows.forwarded: drop empty process.args token from trailing whitespace

The Event ID 4688 command-line tokenizer split winlog.event_data.CommandLine
on whitespace but never discarded empty tokens. Windows records a no-argument
process launch with a trailing space after the quoted executable path, so the
final space produced a spurious empty-string element in process.args and
inflated process.args_count by one (e.g. "...\notepad.exe" with a trailing
space yielded args_count 2 instead of 1). Consecutive spaces between real
arguments had the same effect. This mirrors the same fix already applied to
the system.security pipeline in #20907.

Skip empty tokens both when splitting on whitespace and when emitting the
final token, so process.args and process.args_count reflect the actual
argument list. Add a pipeline test case for a no-argument launch with a
trailing space and bump the package to 3.9.2.

---------

Co-authored-by: Cursor <cursoragent@cursor.com>