[Stack 8.19.18-SNAPSHOT] [forcepoint_web] Failing test daily: system test: logfile in forcepoint_web.logs

- Stack version: 8.19.18-SNAPSHOT
- Package: forcepoint_web
- Failing test: system test: logfile
- DataStream: logs
- Owners:
- @elastic/integration-experience

Error:
```
could not add data stream config to policy: could not create package policy (req {"name":"forcepoint_web-logs-19244","description":"","namespace":"19244","policy_id":"850f0d87-4e3a-4c6d-8eb0-27af0ef68596","package":{"name":"forcepoint_web","version":"1.13.0"},"inputs":{"logs-logfile":{"enabled":true,"streams":{"forcepoint_web.logs":{"enabled":true,"vars":{"paths":["/tmp/service_logs/forcepoint-web-*.log"]}}}}},"force":false}); API status code = 400; response body = {"statusCode":400,"error":"Bad Request","message":"Unexpected scalar at node end at line 3, column 26:\n\nexclude_lines: ['^\"Date']exclude_files: ['\\.gz$']tags: - forwardedpublisher_pi…\n ^^^^^^^^^^^^^\n"}
```

First build failed: https://buildkite.com/elastic/integrations/builds/45218

Latest 5 failed builds:
- https://buildkite.com/elastic/integrations/builds/45763
- https://buildkite.com/elastic/integrations/builds/45841
- https://buildkite.com/elastic/integrations/builds/45909
- https://buildkite.com/elastic/integrations/builds/45972
- https://buildkite.com/elastic/integrations/builds/46036

Start with the forcepoint_web system test named "logfile" and compare the failing output from the linked Buildkite runs. Trace how the forcepoint_web logs DataStream configuration is assembled, then verify that the package policy is accepted and the system test passes without the YAML parsing error.

Written by the indexing model from the issue text.