Add a couple of decoders to decode the ruser field. Based on log samples
from sgtzeno5 at googlemail.
Merge branch 'master' of https://github.com/ossec/ossec-hids into more_pam
Initial tests for pam.

It would be great if runtests supported the decoded fields (maybe
it does?). My pam decoder changes may change some of these (100%
for some subset of log messages). It would be nice to be able to
track those changes with this tool.
Merge pull request #255 from ddpbsd/more_pam

More Pam match and unittests