CrowdSec — Exim parser silently skips authentication failures

The grok pattern required a set_id capture group that authentication-failure lines never contain, so brute-force attempts against Exim produced no events at all. Fixed by making the group optional, which stays backwards compatible with the existing parser assertions.

A detection gap: credential brute-force against Exim generated no alerts.