[Stack 8.19.19-SNAPSHOT] [forcepoint_web] Failing test daily: system test: logfile in forcepoint_web.logs

- Stack version: 8.19.19-SNAPSHOT
- Package: forcepoint_web
- Failing test: system test: logfile
- DataStream: logs
- Owners:
- @elastic/integration-experience

Error:
```
could not add data stream config to policy: could not create package policy (req {"name":"forcepoint_web-logs-34535","description":"","namespace":"34535","policy_id":"1d8d68ae-d957-4c43-91ec-8026d73f4c59","package":{"name":"forcepoint_web","version":"1.13.0"},"inputs":{"logs-logfile":{"enabled":true,"streams":{"forcepoint_web.logs":{"enabled":true,"vars":{"paths":["/tmp/service_logs/forcepoint-web-*.log"]}}}}},"force":false}); API status code = 400; response body = {"statusCode":400,"error":"Bad Request","message":"Unexpected scalar at node end at line 3, column 26:\n\nexclude_lines: ['^\"Date']exclude_files: ['\\.gz$']tags: - forwardedpublisher_pi…\n ^^^^^^^^^^^^^\n"}
```

First build failed: https://buildkite.com/elastic/integrations/builds/46081

Latest 5 failed builds:
- https://buildkite.com/elastic/integrations/builds/46710
- https://buildkite.com/elastic/integrations/builds/46801
- https://buildkite.com/elastic/integrations/builds/46859
- https://buildkite.com/elastic/integrations/builds/46920
- https://buildkite.com/elastic/integrations/builds/47003

Start by reproducing the `forcepoint_web` `system test: logfile` failure for the `logs` data stream, using the linked Buildkite failures as context. Inspect the generated package policy around the reported `exclude_lines`, `exclude_files`, and `tags` content; done means the package policy is accepted and the system test passes consistently.

Written by the indexing model from the issue text.