Make 'if "something" not in [nonexistent] { ... }' succeed

My argument is checking for the absence of a value in a field that doesn't exist should return true, currently it is false.

This fixes the case where an event which has never been tagged now works with this logic:

    grok {
      ...
    }
    if "_grokparsefailure" not in [tags] {
      ...
    }

Tests updated and still pass, fixes [LOGSTASH-1412](https://logstash.jira.com/browse/LOGSTASH-1412).