Fixes elastic#21658

For messages 716002:
- Changed to GROK; allows for better parsing of event.reason
- Added field for cisco.webvpn.group_name
- Added field for event.reason per cisco docs for why session was terminated
- Added field for cisco.termination_user for the AAA username terminating the connection

For messages 722051:
- Add angle brackets to dissect to properly dissect the message, per cisco docs
- Added field for cisco.webvpn.group.name

For messages 305011:
- Change to GROK; allows for variance in message format with identity firewall

For messages 302020:
- Added GROK pattern to allows for variance in message format with identity firewall

For messages 302014/302016/302021:
- Added patterns and modified order of patterns of GROK to better match teardown messages
- Note that order of processing is important as the most specific messages are matched first, falling through to the appropriate match.
- Added temp fields for teardown initiator and user; defined in cisco docs but currently no real place to put them, but could be in future.
- Added icmp_type and icmp_code parsing for 302021 messages
- Changed duration matching from TIME to NOTSPACE, as long-lived connections (over 24 hours) don't match TIME.

And:

- Added descriptions to many fields to make them easier to find in 7.9+ Kibana Ingest Node Pipeline editor.
- Changed source.bytes field type from integer to long, since long-lived flows can surpass the capacity of an integer; ECS reference field is defined as long.
- Changed destination.bytes type from integer to long, since long-lived flows can surpass the capacity of an integer; ECS reference field is defined as long.

(cherry picked from commit b5e43fc)

Fixes #21658

For messages 716002:
- Changed to GROK; allows for better parsing of event.reason
- Added field for cisco.webvpn.group_name
- Added field for event.reason per cisco docs for why session was terminated
- Added field for cisco.termination_user for the AAA username terminating the connection

For messages 722051:
- Add angle brackets to dissect to properly dissect the message, per cisco docs
- Added field for cisco.webvpn.group.name

For messages 305011:
- Change to GROK; allows for variance in message format with identity firewall

For messages 302020:
- Added GROK pattern to allows for variance in message format with identity firewall

For messages 302014/302016/302021:
- Added patterns and modified order of patterns of GROK to better match teardown messages
- Note that order of processing is important as the most specific messages are matched first, falling through to the appropriate match.
- Added temp fields for teardown initiator and user; defined in cisco docs but currently no real place to put them, but could be in future.
- Added icmp_type and icmp_code parsing for 302021 messages
- Changed duration matching from TIME to NOTSPACE, as long-lived connections (over 24 hours) don't match TIME.

And:

- Added descriptions to many fields to make them easier to find in 7.9+ Kibana Ingest Node Pipeline editor.
- Changed source.bytes field type from integer to long, since long-lived flows can surpass the capacity of an integer; ECS reference field is defined as long.
- Changed destination.bytes type from integer to long, since long-lived flows can surpass the capacity of an integer; ECS reference field is defined as long.

(cherry picked from commit b5e43fc)

Co-authored-by: hitchatwork <56573831+hitchatwork@users.noreply.github.com>