[aws.s3access] Grok fails on CloudFront Origin Access Identity requester

### Integration Name

AWS [packages/aws]

### Dataset Name

aws.s3access

### Integration Version

(all)

### Problem

S3 server access logs from CloudFront Origin Access Identity (OAI) requests fail ingest grok parsing. The requester field contains spaces, and `S3REQUESTER` does not allow spaces, so those events land as `event.kind: pipeline_error`.

Example:

```
arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E2EXAMPLEID
```

This is a real AWS principal ARN format for CloudFront OAI (see [CloudFront OAI docs](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html)).

But it fails current pattern:

```yaml
S3REQUESTER: "[a-zA-Z0-9\\/_\\.\\-%:@]+"
```

Start in packages/aws and locate the aws.s3access ingest pattern containing S3REQUESTER. Check the parser against the CloudFront Origin Access Identity ARN shown in the issue; it is done when that requester with spaces is accepted without producing event.kind: pipeline_error.

Written by the indexing model from the issue text.