parser_syslog: accept a space after RFC3164 priority

[AkashKumar7902]

Which issue(s) this PR fixes:
Fixes #4158

What this PR does / why we need it:

Some syslog senders emit RFC3164 records with an ASCII space between the priority and header. Depending on whether in_syslog or the parser owns priority extraction, the RFC3164 parser sees that space either immediately after > or as the first character of its input, and currently attempts to parse it as the start of the timestamp.

This change accepts the RFC3164 boundary space in rfc3164 and the RFC3164 path of auto, across both parser engines and both priority-ownership models. Canonical records without the space continue to parse unchanged, malformed priorities remain invalid, and RFC5424 parsing is unchanged.

For the default RFC3164 time format, regression coverage verifies that two boundary spaces and tabs remain invalid. An explicit RFC3164 time_format beginning with a space treats that leading space as timestamp syntax, so this change does not impose or claim a one-space maximum for that configuration.

This also corrects the string parser's dynamic timestamp slice cursor and the field-count accounting needed by RFC3164 time formats that begin with a space. Truncated subsecond records with the boundary space are rejected through the normal [nil, nil] path instead of raising while looking for the missing field delimiter.

Docs Changes:

None. This broadens input compatibility without adding or changing configuration.

Release Note:

parser_syslog: accept one optional ASCII space between RFC3164 priority and header.

Testing:

• bundle exec ruby -Itest test/plugin/test_parser_syslog.rb --name test_truncated_subsecond_rfc3164_is_rejected_without_raising — 4 tests, 12 assertions, 0 failures, 0 errors across rfc3164/auto and parser-owned/input-owned priority
• bundle exec ruby -Itest test/plugin/test_parser_syslog.rb — 132 tests, 521 assertions, 0 failures, 0 errors
• bundle exec ruby -Itest test/plugin/test_in_syslog.rb — 41 tests, 280 assertions, 0 failures, 0 errors
• bundle exec rake test — 4,401 tests, 16,154 assertions, 0 failures, 0 errors, 3 pendings, 36 omissions
• gem exec rubocop — 460 files inspected, 0 offenses
• Balanced microbenchmark with 8 samples per revision and case — all 8 prespecified fixed regression gates passed. The narrowest throughput ratio was 0.953; this was used only as a regression gate, and no performance improvement is claimed.
• Installed-gem UDP validation — 20/20 scenarios passed. Both baseline and candidate gems were built and installed into isolated environments, real fluentd --no-supervisor processes were started, and packets were sent by external UDP clients. The original 16-scenario matrix covered both parser engines, both priority-ownership models, rfc3164/auto, canonical and spaced packets, whitespace rejection, RFC5424 compatibility, and explicit leading-space time formats. Four additional string-parser scenarios verified that the truncated subsecond packet takes the normal unmatched path without an exception and that a valid .5 sibling is parsed by the same live process across rfc3164/auto and both priority-ownership modes.

[Watson1978]

The following test should pass. It works on the master branch, but on this PR the behavior changes and it fails.

  data(
    'boundary space' => '<14> Apr 25 16:43:29.5',
  )
  def test_truncated_subsecond_rfc3164_is_rejected_without_raising(text)
    @parser.configure(
      'parser_engine'  => 'string',
      'message_format' => 'rfc3164',
      'with_priority'  => true,
      'time_format'    => '%b %d %H:%M:%S.%N',
    )

    result = :not_yielded
    assert_nothing_raised do
      @parser.instance.parse(text) do |time, record|
        result = [time, record]
      end
    end
    assert_equal([nil, nil], result)
  end

On master, the input <14> Apr 25 16:43:29.5 (a truncated message with a boundary space, no host/message) is gracefully rejected as [nil, nil].
On this PR it raises NoMethodError(<undefined method '-' for nil>) instead.

Please add above test case in this PR.

[AkashKumar7902]

Thanks for catching this. Addressed in 65e84da7:

• The string parser now checks for the missing field delimiter before subtracting the cursor and rejects the truncated record through the normal [nil, nil] path.
• The requested <14> Apr 25 16:43:29.5 case is covered. I extended the same table-driven test across rfc3164/auto and parser-owned/input-owned priority, with a valid .5 host app: message control for each route.

Validation on the published SHA:

• focused regression: 4 tests, 12 assertions
• syslog parser/input suites: 132/521 and 41/280
• full suite: 4,401 tests, 16,154 assertions, 0 failures, 0 errors
• RuboCop: 460 files, 0 offenses
• installed-gem UDP matrix: 20/20 scenarios, including no exception/error/backtrace for all four truncated-subsecond routes and successful recovery on the same process

There is no inline review thread to resolve, so I’m replying in the PR conversation. The branch is ready for re-review. Hosted Test, Benchmark, and RuboCop runs were created for the new head and are awaiting the repository’s maintainer-approval gate for fork workflows.