Add Stage0 RFC for new fields for fileless execution on Linux

Have you signed the contributor license agreement? - Yes
Have you followed the contributor guidelines? - Yes
For proposing substantial changes or additions to the schema, have you reviewed the RFC process? - Yes
If submitting code/script changes, have you verified all tests pass locally using make test? - N/A
If submitting schema/fields updates, have you generated new artifacts by running make and committed those changes? - N/A
Is your pull request against main? Unless there is a good reason otherwise, we prefer pull requests against main and will backport as needed. - Yes
Have you added an entry to the CHANGELOG.next.md? - N/A

elastic / ecs