Parse verbose SSH invalid-user traces

[stacknil]

Summary

• parse input_userauth_request: invalid/illegal user ... preauth traces as source-less ssh_invalid_user events
• accept OpenSSH's optional error: marker on sshd-owned PAM: Authentication failure ... lines, including invalid/illegal-user variants
• expand syslog and journalctl parser fixture coverage, update parser-contract docs, and pin tracked .log fixtures to LF line endings

Validation

• cmake --build build --config Debug
• ctest --test-dir build -C Debug --output-on-failure
• git diff --check main...HEAD
• commit diff scans for local paths, secret assignment patterns, private-key markers, and non-documentation IP addresses

Safety

• Fixture additions use example-host and 203.0.113.x documentation addresses only.
• No new event enum or detector mapping; variants normalize into existing event families.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.