[bug-hunter] Ping Federate bracket stripping misses IPv4-mapped IPv6 and breaks CEF parsing

## Impact
`ping_federate` audit events with bracketed IPv4-mapped IPv6 addresses (for example `src=[::ffff:192.0.2.128]`) are not normalized before `decode_cef`. This can cause parse failures or missing source IP extraction for valid address formats, resulting in dropped or partially parsed events.

## Reproduction Steps
1. Save and run this script:
````js
const pattern = /\[([0-9a-fA-F:]+)\]/gi;

const cases = [
{
name: 'pure IPv6 bracketed',
input: 'CEF:0|Ping|Fed|1|x|x|0|src=[2a01:db8::1]',
expected: 'CEF:0|Ping|Fed|1|x|x|0|src=2a01:db8::1',
},
{
name: 'IPv4-mapped IPv6 bracketed',
input: 'CEF:0|Ping|Fed|1|x|x|0|src=[::ffff:192.0.2.128]',
expected: 'CEF:0|Ping|Fed|1|x|x|0|src=::ffff:192.0.2.128',
},
];

let failed = false;
for (const tc of cases) {
const actual = tc.input.replace(pattern, '$1');
const ok = actual === tc.expected;
console.log(`\$\{ok ? 'PASS' : 'FAIL'}: \$\{tc.name}`);
console.log(` input : \$\{tc.input}`);
console.log(` expected: \$\{tc.expected}`);
console.log(` actual : \$\{actual}`);
if (!ok) failed = true;
}

if (failed) process.exit(1);
```
2. Run: `node ping_federate_ipv6_repro.js`

## Expected vs Actual
**Expected:** Both bracketed IPv6 forms are normalized (brackets removed) before CEF decode.

**Actual:** Pure IPv6 passes, but IPv4-mapped IPv6 remains bracketed and fails normalization.

Observed output:
```
PASS: pure IPv6 bracketed
FAIL: IPv4-mapped IPv6 bracketed
input : CEF:0|Ping|Fed|1|x|x|0|src=[::ffff:192.0.2.128]
expected: CEF:0|Ping|Fed|1|x|x|0|src=::ffff:192.0.2.128
actual : CEF:0|Ping|Fed|1|x|x|0|src=[::ffff:192.0.2.128]
````

## Failing Test
```js
const pattern = /\[([0-9a-fA-F:]+)\]/gi;

const cases = [
{
name: 'pure IPv6 bracketed',
input: 'CEF:0|Ping|Fed|1|x|x|0|src=[2a01:db8::1]',
expected: 'CEF:0|Ping|Fed|1|x|x|0|src=2a01:db8::1',
},
{
name: 'IPv4-mapped IPv6 bracketed',
input: 'CEF:0|Ping|Fed|1|x|x|0|src=[::ffff:192.0.2.128]',
expected: 'CEF:0|Ping|Fed|1|x|x|0|src=::ffff:192.0.2.128',
},
];

let failed = false;
for (const tc of cases) {
const actual = tc.input.replace(pattern, '$1');
const ok = actual === tc.expected;
console.log(`\$\{ok ? 'PASS' : 'FAIL'}: \$\{tc.name}`);
if (!ok) failed = true;
}
if (failed) process.exit(1);
```

## Evidence
- Regex currently used in all Ping Federate audit input templates only matches hex+colon characters, excluding dots:
- `packages/ping_federate/data_stream/audit/agent/stream/filestream.yml.hbs:33`
- `packages/ping_federate/data_stream/audit/agent/stream/tcp.yml.hbs:35`
- `packages/ping_federate/data_stream/audit/agent/stream/udp.yml.hbs:32`
- Current expression: `msg.replace(/\[([0-9a-fA-F:]+)\]/gi, "$1")`
- This came from commit `d715d0178e` and does not handle IPv4-mapped IPv6 (`::ffff:192.0.2.128`).

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Bug Hunter](https://github.com/elastic/integrations/actions/runs/23340287251)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on Mar 27, 2026, 11:20 AM UTC