deprecate use_journal - add lookup_from_k8s_field - detect input

Instead of the user having to specify what the source of the container logs are, journal or json-file, let the plugin automatically figure it out by default. If there are fields named CONTAINER_NAME and CONTAINER_ID_FULL and they match the correct pattern, assume this is a journald record. Otherwise, if the tag matches the k8s filename tag, assume this is a json-file/crio file record. Otherwise, if there are already kubernetes fields in the record like kubernetes.namespace_name, kubernetes.pod_name, etc. assume the user is providing the metadata explicitly. You can still use the use_journal true flag if absolutely necessary, but don't.