Add OriginalFileName, Hashes and ParentUser to the process_creation field table

[alephnull-sh]

The process_creation field table in the taxonomy appendix is missing three fields that Sysmon event 1 emits and that the rules repo already uses:

• OriginalFileName: used by 580 of the 1182 process_creation rules in SigmaHQ/sigma (checked at fe2a6e8, 2026-07-08)
• Hashes: 39 rules
• ParentUser: 2 rules

Easy to verify against a rules clone:

grep -rl OriginalFileName rules/windows/process_creation | wc -l   # 580
grep -rl Hashes           rules/windows/process_creation | wc -l   # 39
grep -rl ParentUser       rules/windows/process_creation | wc -l   # 2

Since the appendix describes this table as the allowed field names for rules shared on the official repo, it seems worth fixing that OriginalFileName isn't in it. It's actually the fourth most used field in the whole corpus at this point.

On Hashes: the table already lists imphash/md5/sha1/sha256, but those are the split-out forms that pipelines produce. Hashes is the raw field Sysmon emits, and rules match on it directly (Hashes|contains: 'IMPHASH=...'), so I think both belong.

I put the new rows in the order Sysmon emits them and reused the GoogleUpdate example values that are already in the table.

For context, I noticed this while running a corpus check with a static analysis tool I'm building (https://github.com/Big-Comfy/detsema), but the grep above is all that's needed to confirm it.