[decode_cef] Updates for ArcSight Common Event Format (CEF) - Version 26

**Describe the enhancement:**

There is a update to the CEF specification and we should update our [decode_cef](https://www.elastic.co/guide/en/beats/filebeat/current/processor-decode-cef.html) processor to account for any changes.

We need to analyze differences between the two to see what changed. There's a `CEF:1` described in this v26 document. We need to check if there were any breaking changes that need special handling or if there were only additions (like new keys names, e.g. customerKey).

- [v25](https://archive.org/download/commoneventformatv25/CommonEventFormatV25.pdf)
- [v26](https://web.archive.org/web/20240312031028/https://www.microfocus.com/documentation/arcsight/arcsight-smartconnectors-8.4/pdfdoc/cef-implementation-standard/cef-implementation-standard.pdf)
- [v27](https://web.archive.org/web/20240925170528/https://www.microfocus.com/documentation/arcsight/arcsight-smartconnectors-24.2/pdfdoc/cef-implementation-standard/cef-implementation-standard.pdf)

Start with the decode_cef processor and compare the linked CEF v25, v26, and v27 specifications. Identify breaking changes versus additions such as customerKey, then determine which v26 differences require processor handling. Done means the processor accounts for the applicable v26 changes and its behavior is verified.

Written by the indexing model from the issue text.