[LOGSTASH-1630] Syslog 5424 patterns fail to match additional spaces

https://logstash.jira.com/browse/LOGSTASH-1630

Split the start of `SYSLOG5424LINE` out to `SYSLOG5424BASE`, in case people
want to create `PAM` or `CRON` patterns, similar to those available for `SYSLOG`

Also make syslog5424_sd optionally match nothing, since it seems to be 
ommitted entirely with rsyslog's `RSYSLOG_SyslogProtocol23Format` (ie - there
is no SD data, and it is not correctly replaced with a `-`).