Improving logs-vsphere.log-1.19.0 Pipeline Parsing Logic

### Description

The request is to enhance the existing logs-vsphere.log-1.19.0 pipeline to better handle authentication events from vSphere/vCenter. The following improvements are proposed:

1. **Parsing the Main Pipeline**:
- Update the if condition in the main pipeline to trigger on the word "rejected" to parse failed authentication attempts where the password was incorrect.

```json
{
"pipeline": {
"name": "logs-vsphere.log-1.19.0-login",
"if": "((ctx.message != null && (ctx.message.contains('logged') || ctx.message.toLowerCase().contains('login'))) || (ctx.log?.logger != null && ['vim.event.UserLogoutSessionEvent', 'vim.event.UserLogoutSessionEvent'].contains(ctx.log.logger)) || ctx.message.toLowerCase().contains('rejected')) || ctx.process?.name == 'sshd'"
}
}
```

2. **Copy client.ip to source.ip**:
- For consistency with other integrations and ECS field expectations, copy `client.ip` to `source.ip`.

```json
{
"set": {
"ignore_empty_value": true,
"description": "Copies \"client.ip\" to \"source.ip\"",
"override": false,
"field": "source.ip",
"copy_from": "client.ip"
}
}
```

3. **Pipeline Enhancements: logs-vsphere.log-1.19.0-login**:
- Add parsing logic for various login-related messages not fully handled by the current pipeline.

**Example 1: Parsing Successful Logins from vpxd**

```json
{
"dissect": {
"pattern": "[%{}] [] [%{}] [%{event.outcome} login %{user.name} from %{client.ip} %{}",
"ignore_failure": true,
"description": "login from",
"field": "message"
}
}
```

**Example 2: Parsing Failed Logins from vpxd**

```json
{
"dissect": {
"pattern": "[%{}] [%{}] [%{}] [%{event.outcome} login %{user.name}@%{client.ip}]",
"ignore_failure": true,
"description": "failed login from",
"field": "message"
}
}
```

**Example 3: Hostd login failure ("Rejected password")**

```json
{
"dissect": {
"pattern": "[%{}] %{event.outcome} %{} for user %{user.name} from %{client.ip} %{}",
"ignore_failure": true,
"description": "failed login reason from",
"field": "message"
}
}
```

4. **Normalizing event.outcome**:
- Ensure consistent mapping of `event.outcome`.

```json
{
"set": {
"field": "event.outcome",
"value": "success",
"if": "(ctx.event?.outcome == null || ctx.event?.outcome?.toLowerCase()?.startsWith('s')) && (ctx.user?.name != null || ctx.user?.domain != null)"
}
},
{
"set": {
"field": "event.outcome",
"value": "failure",
"if": "ctx.event?.outcome?.toLowerCase()?.startsWith('f') || ctx.event?.outcome?.toLowerCase()?.startsWith('c') || ctx.event?.outcome?.toLowerCase()?.startsWith('r')"
}
}
```

These enhancements aim to improve the accuracy and completeness of log parsing for authentication events, thereby enhancing security monitoring capabilities.

The attached files contain the proposed corrected version of the pipeline, including all changes described above.

[logs-vsphere.log-1.19.0-login.json](https://github.com/user-attachments/files/21769261/logs-vsphere.log-1.19.0-login.json)
[logs-vsphere.log-1.19.0.json](https://github.com/user-attachments/files/21769262/logs-vsphere.log-1.19.0.json)