[panw] enhance grok patterns for audit datastream

### Summary

I have a multitude of firewalls sending me logs across different companies and versions of PA. For some reason all of their audit type logs match this grok pattern:

`^%{DATA} - - - - %{FIELD:observer.serial_number},%{TIMESTAMP:_temp_.generated_time},%{FIELD:panw.panos.type},%{GREEDYDATA:message}$`

instead of the two patterns listed in the grok processor of the `logs-panw.panos-5.2.1` pipeline.

Can this pattern be added to the patterns in the grok processor of `logs-panw.panos-5.2.1` pipeline?

I had to modify a "managed" pipeline (which I received a warning about) in order to get my audit logs to parse correctly