[LogsDB] [Stack 8.19.18-SNAPSHOT] [forcepoint_web] Failing test daily: system test: logfile in forcepoint_web.logs

- Stack version: 8.19.18-SNAPSHOT
- LogsDB: enabled
- Package: forcepoint_web
- Failing test: system test: logfile
- DataStream: logs
- Owners:
- @elastic/integration-experience

Error:
```
could not add data stream config to policy: could not create package policy (req {"name":"forcepoint_web-logs-77717","description":"","namespace":"77717","policy_id":"094442ad-676c-4850-af92-8a8cf8acb117","package":{"name":"forcepoint_web","version":"1.13.0"},"inputs":{"logs-logfile":{"enabled":true,"streams":{"forcepoint_web.logs":{"enabled":true,"vars":{"paths":["/tmp/service_logs/forcepoint-web-*.log"]}}}}},"force":false}); API status code = 400; response body = {"statusCode":400,"error":"Bad Request","message":"Unexpected scalar at node end at line 3, column 26:\n\nexclude_lines: ['^\"Date']exclude_files: ['\\.gz$']tags: - forwardedpublisher_pi…\n ^^^^^^^^^^^^^\n"}
```

First build failed: https://buildkite.com/elastic/integrations/builds/45219

Latest 5 failed builds:
- https://buildkite.com/elastic/integrations/builds/45764
- https://buildkite.com/elastic/integrations/builds/45840
- https://buildkite.com/elastic/integrations/builds/45910
- https://buildkite.com/elastic/integrations/builds/45971
- https://buildkite.com/elastic/integrations/builds/46035

Start by running the forcepoint_web system test for the logfile data stream and compare the generated package policy with the error around exclude_lines, exclude_files, and tags. Trace the forcepoint_web package configuration that produces this policy. Done means the test creates the package policy successfully and the latest system-test builds pass.

Written by the indexing model from the issue text.