[Oracle] Update grok pattern for audit logs

[P1llus]

What does this PR do?

There are some usecases in which the action field has another special pattern that does not fit the grok pattern, this update resolves that, and adds another test case.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Related issues

• Closes Elastic-Agent: Oracle Database Audit Logs Parser #4299

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[elasticmachine]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2022-10-11T14:52:01.217+0000

• Duration: 14 min 42 sec

Test stats 🧪

Test	Results
Failed	0
Passed	21
Skipped	0
Total	21

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[elasticmachine]

🌐 Coverage report

Name	Metrics % (covered/total)	Diff
Packages	100.0% (1/1)	💚
Files	100.0% (1/1)	💚 2.525
Classes	100.0% (1/1)	💚 2.525
Methods	82.759% (24/29)	👎 -7.882
Lines	92.574% (187/202)	👍 1.2
Conditionals	100.0% (0/0)	💚

[P1llus]

Adding some small changes still to strip quotes from action