OSQuery snapshot support needs to be merged

I just started trying to build a snapshot-compatible pipeline and discovered the work had already been done over a year ago but never merged.

It is @Kent_Brake 's change https://github.com/elastic/beats/pull/8611

@DPattee Yeah, I struggled a bit trying to merge it (correctly).