iptables: allow parsing of ulogd v2 logs with non-0x prefixed TOS field

[efd6]

What does this PR do?

The formatting of log lines by ulogd v2 does not prefix the TOS field with a hex 0x syntax[1].

buf_cur += sprintf(buf_cur,"LEN=%u TOS=%02X PREC=0x%02X TTL=%u ID=%u ",
		   ikey_get_u16(&res[KEY_IP_TOTLEN]),
		   ikey_get_u8(&res[KEY_IP_TOS]) & IPTOS_TOS_MASK,
		   ikey_get_u8(&res[KEY_IP_TOS]) & IPTOS_PREC_MASK,
		   ikey_get_u8(&res[KEY_IP_TTL]),
		   ikey_get_u16(&res[KEY_IP_ID]));

So make sure that we allow log lines without this syntax to be parsed.

[1]https://github.com/bootc/ulogd2/blob/f985da47cbfa24b6ec0b6fcbebe1ada09e31ee35/util/printpkt.c#L213-L218

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• [ ]

How to test this PR locally

Related issues

• Relates [iptables module] Accept TOS to not provide 0x HEX format beats#32126

Screenshots

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2022-10-20T04:18:42.068+0000

• Duration: 16 min 5 sec

Test stats 🧪

Test	Results
Failed	0
Passed	23
Skipped	1
Total	24

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[elasticmachine]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[elasticmachine]

🌐 Coverage report

Name	Metrics % (covered/total)	Diff
Packages	100.0% (1/1)	💚
Files	100.0% (1/1)	💚 2.465
Classes	100.0% (1/1)	💚 2.465
Methods	100.0% (16/16)	💚 9.131
Lines	92.453% (294/318)	👍 2.031
Conditionals	100.0% (0/0)	💚

[andrewkroh]

Thanks for tracking down the ulog2 source that supports making this change. LGTM