Figure out if we need to adjust Palo USERID template

As mentioned in #719, there is currently an open question regarding the User Group Flags (position 32) and User by Source (position 32) fields in the USERID log type. Per the Palo schema, positions 30 and 31 should be reserved for future use. However, test logs obtained both from SumoLogic and from Nick's own Palo firewall seem to show User Group Flags in position 30 and User by Source in position 31.

We need to resolve this discrepancy before releasing this update.