[system.auth]: Improve parsing of pam_unix(sshd:auth) authentication failure logs in /var/log/secure

### Integration Name

System [system]

### Dataset Name

system.auth

### Integration Version

2.6.3

### Agent Version

9.3.2

### OS Version and Architecture

RHEL9

### User Goal

Users want failed SSH authentication attempts from pam_unix(sshd:auth) logs to be properly parsed into structured ECS fields.

Specifically, they need reliable extraction of:

- user.name
- source.ip
- event.outcome
- event.category / event.type

This enables:

- Detection of brute-force attacks
- Correlation across authentication events
- Building dashboards and alerts based on failed login activity

### Existing Features

The Elastic integration for system/auth logs already parses many SSH-related events (e.g., sshd accepted/failed logins) into ECS fields such as:

- user.name
- source.ip
- event.action
- event.outcome

However, pam_unix(sshd:auth) messages are either:

- Not parsed at all, or
- Parsed only as raw message without structured field extraction

### What did you see?

Example log lines:

```
pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.21.125.9
pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.16.14.13 user=firstname.lastname
```

Observed behavior:

- No structured extraction of rhost → source.ip
- No consistent extraction of user → user.name
- Fields like logname, uid, euid, and tty are not mapped

### Anything else?

Suggested Enhancement

Add parsing rules for pam_unix(sshd:auth): authentication failure messages to:

Extract key-value pairs (rhost, user, etc.)
Map them to ECS fields
Normalize event classification (event.outcome=failure, event.category=authentication)

A grok/dissect pattern could be added to handle:

Variable presence of user
Optional/empty fields (logname=, ruser=)

Additionally:

Graceful handling when user is missing
Consistent parsing whether or not optional fields are present