Enhance auditd log recognition by making "node=" optional

[vikman90]

Related issue
Closes #22066

This PR addresses a bug in our product where logs starting with "node=" were not being recognized properly. I've modified the <prematch> regex option to make the presence of "node=" at the beginning of the log optional. This change ensures that logs both with and without "node=" are correctly identified.

Additionally, I've updated the tests to accommodate this modification, ensuring robustness in our testing suite.

Tests

• Extend ruleset ini tests.
• wazuh-logtest.

🟢 Unchanged

type=PROCTITLE msg=audit(1708637434.880:672): proctitle="su"

Result:

**Phase 2: Completed decoding.
        name: 'auditd'
        audit.id: '672'
        audit.type: 'PROCTITLE'

**Phase 3: Completed filtering (rules).
        id: '80700'
        level: '0'
        description: 'Audit: Messages grouped.'
        groups: '['audit']'
        firedtimes: '1'
        mail: 'False'

🟢 Fixed

node=localhost type=PROCTITLE msg=audit(1708637434.880:672): proctitle="su"

Result:

**Phase 2: Completed decoding.
        name: 'auditd'
        audit.id: '672'
        audit.type: 'PROCTITLE'

**Phase 3: Completed filtering (rules).
        id: '80700'
        level: '0'
        description: 'Audit: Messages grouped.'
        groups: '['audit']'
        firedtimes: '1'
        mail: 'False'

[ooniagbi]

LGTM!