[system]: `pam_unix` password change logs fail to extract username in `auth` data stream

### Integration Name

System [system]

### Dataset Name

system.auth

### Integration Version

2.6.3

### Agent Version

Not provided

### Agent Output Type

elasticsearch

### Elasticsearch Version

Not provided

### OS Version and Architecture

Not provided

### Software/API Version

_No response_

### Error Message

```
Provided Grok expressions do not match field value: [pam_unix(passwd:chauthtok): password changed for e2etest]
```

### Event Original

```
Nov 26 13:13:23 passwd[4343432]: pam_unix(passwd:chauthtok): password changed for e2etest
```

### What did you do?

Customer ingested Linux authentication logs via the default system integration (v2.6.3) with no custom pipeline modifications. Logs containing `pam_unix` password change events were processed through the default `logs-system.auth` ingest pipeline.

### What did you see?

Certain `pam_unix` and PAM log messages fail to parse correctly in the default pipeline. Specifically, password change events of the format `pam_unix(passwd:chauthtok): password changed for ` do not result in username extraction, even though the username is present in the raw log message. Verbose pipeline output confirms the Grok pattern fails to match this message format.

### What did you expect to see?

The username (`e2etest` in the example above) should be extracted and mapped to the appropriate ECS field (ie `user.name`) by the default ingest pipeline, consistent with how other `pam_unix` event types are handled.

### Anything else?

_No response_