[9.3](backport #51716) Load Npcap wpcap.dll lazily to avoid blocking upgrades on Windows

[mergify]

On Windows importing gopacket/pcap used to load wpcap.dll in the package init() (see elastic/gopacket#7).

When elastic-agent runs the collector in process mode, every collector process (not only packetbeat) loads wpcap.dll at startup:

PS C:\Windows\system32> tasklist /m wpcap.dll

Image Name                     PID Modules
========================= ======== ============================================
elastic-otel-collector.exe    1234 wpcap.dll
elastic-otel-collector.exe    5678 wpcap.dll
elastic-otel-collector.exe    9012 wpcap.dll

While any of these processes holds the DLL open, the packetbeat installer cannot replace wpcap.dll to upgrade Npcap.

Load wpcap.dll lazily instead of at package init so only packetbeat loads it and only when needed.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works.
• I have added an entry in ./changelog/fragments using the changelog tool.

Disruptive User Impact

None. wpcap.dll is now loaded on demand instead of at startup. Packetbeat behaves the same but other beats no longer hold the DLL open.

How to test this PR locally

On Windows with an older Npcap already installed, run Packetbeat with the Network Traffic input plus other Beats. Packetbeat should upgrade Npcap and start capturing instead of failing with exit status 2.

Automated: mage systemTest on Windows runs TestWindowsNpcapInstaller, which now also verifies that a process only importing the capture code does not load wpcap.dll.

Related issues

• Closes Packetbeat fails to upgrade on Windows when a newer Npcap version is available elastic-agent#14517
• Requires Make npcap DLL loading lazy instead of loading at init gopacket#7

---

This is an automatic backport of pull request #51716 done by [Mergify](https://mergify.com).

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)
• /test : Run the Buildkite pipeline.

[infra-vault-gh-plugin-prod]

Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform)

[infra-vault-gh-plugin-prod]

Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform)