feat: add parser support for accepted publickey, pam_faillock, and pam_sss variants

[stacknil]

Closes #14

Summary

• add parser support for Accepted publickey success events
• add conservative support for selected pam_faillock and pam_sss failure variants
• keep ambiguous variants in deterministic telemetry buckets
• preserve existing detector thresholds and golden report contract behavior

Scope

This PR is limited to parser-family expansion.
It does not change detector thresholds, cross-host correlation, enrichment, or SIEM-like behavior.
This is a parser-only change; no detector thresholds changed.

What changed

• added sanitized syslog and journalctl_short_full fixtures
• added parser tests for recognized vs telemetry-only behavior
• parsed Accepted publickey as a supported auth event
• parsed stable pam_faillock / pam_sss failure variants into the event model
• retained ambiguous variants as deterministic telemetry buckets

Verification

• cmake --preset dev-debug
• cmake --build --preset dev-debug
• ctest --preset dev-debug
• cmake --preset ci-release
• cmake --build --preset ci-release
• ctest --preset ci-release

Deferred

• broader pam_faillock success / lockout / admin-style variants
• broader pam_sss backend / service-state variants
• detector-policy changes for newly parsed families