pps: handle RFC 6587 octet-counting prefix and fix grok patterns - #17678

pps: handle RFC 6587 octet-counting prefix and fix grok patterns

Newer versions of Pleasant Password Server prepend an RFC 6587
octet count (e.g. "230 ") to syslog messages sent over TCP. The
ingest pipeline's grok patterns anchored to "^<" and rejected
these messages, causing all fields to fall through to the
catch-all pattern.

Add an optional "\d+ " prefix to the two structured grok patterns
so they handle both formats without configuration changes.

Also fix three secondary grok patterns that used character classes
([created|updated], [from|to]) instead of alternation groups
((?:created|updated), (?:from|to)). These matched by accident
because the first character of each word was in the class, but
would not match the intended words correctly.

Expose a tcp_options variable on the TCP input so users can set
framing, max_message_size, or other TCP-level options if needed.

--- Test results for package: pps - START ---
╭─────────┬─────────────┬───────────┬───────────────────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE │ DATA STREAM │ TEST TYPE │ TEST NAME                                             │ RESULT │ TIME ELAPSED │
├─────────┼─────────────┼───────────┼───────────────────────────────────────────────────────┼────────┼──────────────┤
│ pps     │ log         │ pipeline  │ (ingest pipeline warnings test-log-octet-counted.log) │ PASS   │ 523.825084ms │
│ pps     │ log         │ pipeline  │ (ingest pipeline warnings test-log.log)               │ PASS   │ 370.010667ms │
│ pps     │ log         │ pipeline  │ test-log-octet-counted.log                            │ PASS   │   80.66225ms │
│ pps     │ log         │ pipeline  │ test-log.log                                          │ PASS   │ 100.978667ms │
╰─────────┴─────────────┴───────────┴───────────────────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: pps - END   ---
Done