Fix Citrix ADC parsing of TCP CONN_TERMINATE events with trailing whitespace

[qcorporation]

Proposed commit message

Fixes parsing of TCP CONN_TERMINATE events in the Citrix ADC integration.
Previously, Source IP/Port, Destination IP/Port, Total_bytes_send, and
Total_bytes_recv were not extracted from the message payload.

• Added/extended grok pattern to capture these fields and map them to
  source.ip, source.port, destination.ip, destination.port,
  source.bytes, destination.bytes.
• Added pipeline test coverage for CONN_TERMINATE events.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• elastic-package test pipeline --data-stream log passes (new + existing events)
• elastic-package check clean
• Manual verification: ingest the customer's sample message through the updated pipeline; confirm all six fields are present in the resulting document.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

Pinging @elastic/integration-experience (Team:Integration-Experience)

[robester0403]

Look good.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: e732959

History

• 💚 Build #41510 succeeded b56eef0
• 💚 Build #41464 succeeded 3f70a7a
• 💚 Build #41461 succeeded 2519078

cc @qcorporation

[elastic-vault-github-plugin-prod]

Package citrix_adc - 1.18.5 containing this change is available at https://epr.elastic.co/package/citrix_adc/1.18.5/