[LOGSTASH-1630] Syslog 5424 patterns fail to match additional spaces

https://logstash.jira.com/browse/LOGSTASH-1630

Split the start of `SYSLOG5424LINE` out to `SYSLOG5424BASE`, in case
people want to create PAM or CRON patterns, similar to those available
for `SYSLOG`.

Also make syslog5424_sd optionally match nothing, since it seems to be
ommitted entirely with rsyslog's `RSYSLOG_SyslogProtocol23Format` (ie -
there is no SD data, and it is not correctly replaced with a `-`).
Merge pull request #791 from pdf/LOGSTASH-1630

[LOGSTASH-1630] Syslog 5424 patterns fail to match additional spaces