Update to the firewalls pattern file

Parse the access-list action log messages more consistently.  This changes the policy_id pattern from WORD to NOTSPACE and the src_ip/dst_ip from IP to IPORHOST