text: Title: Allow actions to provide ECS data for the event log
  Body: With the coming event log, it probably makes sense for actions to provide ECS-compatible data on what they're doing, if they have anything.  For instance, any action using an http service could provide data from the [http fieldset](https://www.elastic.co/guide/en/ecs/current/ecs-http.html).
  
  Not sure the best way to provide this ATM.  We could either pass an event logger into the action, and then let the action do the logging, or allow the action to return data to be added to the event log document generated for an action execution.