Update sshd pipeline and map OCSF attributes

[nbeckstead-ddog]

What does this PR do?

This PR adds OCSF attributes to sshd logs. It also adjusts the pipeline to extract the user during attempts to authenticate as an invalid user, which is common during bruteforce attempts.

Motivation

Writing SIEM detections on ssh logs.

Review checklist (to be filled by reviewers)

• Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
• Add the qa/skip-qa label if the PR doesn't need to be tested during QA.
• If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged