[Fortinet Fortigate]: Control on dissect with tag "ssh login 2" in pipeline "logs-fortinet_fortigate.log-1.36.8-login" is not strict enough

### Integration Name

Fortinet FortiGate Firewall Logs [packages/fortinet_fortigate]

### Dataset Name

fortinet_fortigate.log

### Integration Version

1.36.8

### Agent Version

9.3.5

### Agent Output Type

logstash

### Elasticsearch Version

9.3.5

### OS Version and Architecture

Docker

### Software/API Version

_No response_

### Error Message

Processor dissect with tag ssh login 2 in pipeline logs-fortinet_fortigate.log-1.36.8-login failed with message: Unable to find match for dissect pattern: %{_tmp.user.roles} %{user.name} login %{event.outcome} from %{}(%{source.ip}) %{} against source: Administrator admin login failed from console because of invalid password

### Event Original

"<185>date=2026-07-21 time=10:36:31 devname=\"devname\" devid=\"FGT60FXXXXXXXX\" eventtime=1784630191306647240 tz=\"+0000\" logid=\"0100032002\" type=\"event\" subtype=\"system\" level=\"alert\" vd=\"root\" logdesc=\"Admin login failed\" sn=\"0\" user=\"admin\" ui=\"console\" method=\"console\" srcip=0.0.0.0 dstip=0.0.0.0 action=\"login\" status=\"failed\" reason=\"passwd_invalid\" msg=\"Administrator admin login failed from console because of invalid password\""

### What did you do?

The integration does not have any special configuration applied other than a custom ingest port.

### What did you see?

I regularly check for events with error.message in that dataset and noticed that this error message pops up from time to time.

### What did you expect to see?

There's a processor with tag "ssh login 3" which can handle the success of this message, however there's no processor for failed logins. As "ssh login 2" expect parentheses the Dissect does not match.
Either:
- "ssh login 2" should be changed to a Grok with multiple patterns
- %{WORD:_tmp.user.roles} %{NOTSPACE:user.name} login %{WORD:event.outcome} from (?:jsconsole|%{WORD}(?:\(%{IP:source.ip}\))?)
- "ssh login 3" should have different conditionals and a second grok pattern, tighten conditional in "ssh login 2"
- Add a new processor with these patterns and tighten conditional in "ssh login 2":
%{WORD:_tmp.user.roles} %{NOTSPACE:user.name} login %{WORD:event.outcome} from (?:jsconsole|%{WORD}(?:\(%{IP:source.ip}\))?)

Conditional:
ctx.message != null && ctx.message.startsWith('Administrator') && !ctx.message.toLowerCase().contains('logged in')

### Anything else?

_No response_