Parse sshd PAM auth failure variants

[stacknil]

Summary

• parse sshd-owned PAM: Authentication failure ... lines into the existing event model
• normalize sshd PAM invalid/illegal-user variants to ssh_invalid_user events
• expand auth-family syslog and journalctl fixtures plus parser tests
• document the supported parser behavior

Validation

• cmake -S . -B build
• cmake --build build
• ctest --test-dir build -C Debug --output-on-failure -R parser
• ctest --test-dir build -C Debug --output-on-failure
• git diff --check
• privacy/sensitive-string scan on touched files