Fields missing from joined tstats

[TheLawsOfChaos]

https://github.com/splunk/security_content/blob/aeceacc7378e501c4fd3b01816e1d6dc1e34de8c/detections/endpoint/registry_keys_used_for_persistence.yml#L29-L32

Joined subsearch needs to have Processes.user & Processes.process_path added into it, as the fields at the end is trying to use them and they aren't grabbed from the tstats.

While user could be used from the top search, process_path is not defined in that EventCode/search so has to be used from the joined tstats line.

[tccontre]

fix is in PR https://github.com/splunk/security_content/pull/2298