pcre2 fix for windows1 decoders

[ddpbsd]

The pcre for the second instances of Account Name and Account Domain were grabbing too much. So modify them to only grab the username and domain name.

Before:

**Phase 1: Completed pre-decoding.
       full event: '2020 May 22 18:48:00 WinEvtLog: Security: AUDIT_SUCCESS(4624): Microsoft-Windows-Security-Auditing: WIN2K19$: AD.LAB.WAFFLELAB.ONLINE: win2k19.ad.lab.wafflelab.online: An account was successfully logged on. Subject:  Security ID:  S-1-0-0  Account Name:  -  Account Domain:  -  Logon ID:  0x0  Logon Type:   3  New Logon:  Security ID:  S-1-5-18  Account Name:  WIN2K19$  Account Domain:  AD.LAB.WAFFLELAB.ONLINE  Logon ID:  0x8bde76  Logon GUID:  {5dad7a1a-1019-4313-85d1-4687ded0cc57}  Process Information:  Process ID:  0x0  Process Name:  -  Network Information:  Workstation Name: -  Source Network Address: ::1  Source Port:  59801  Detailed Authentication Information:  Logon Process:  Kerberos  Authentication Package: Kerberos  Transited Services: -  Package Name (NTLM only): -  Key Length:  0  This event is generated when a logon session is created. It is generated on the computer that was accessed.'
       hostname: 'arrakis'
       program_name: 'WinEvtLog'
       log: 'Security: AUDIT_SUCCESS(4624): Microsoft-Windows-Security-Auditing: WIN2K19$: AD.LAB.WAFFLELAB.ONLINE: win2k19.ad.lab.wafflelab.online: An account was successfully logged on. Subject:  Security ID:  S-1-0-0  Account Name:  -  Account Domain:  -  Logon ID:  0x0  Logon Type:   3  New Logon:  Security ID:  S-1-5-18  Account Name:  WIN2K19$  Account Domain:  AD.LAB.WAFFLELAB.ONLINE  Logon ID:  0x8bde76  Logon GUID:  {5dad7a1a-1019-4313-85d1-4687ded0cc57}  Process Information:  Process ID:  0x0  Process Name:  -  Network Information:  Workstation Name: -  Source Network Address: ::1  Source Port:  59801  Detailed Authentication Information:  Logon Process:  Kerberos  Authentication Package: Kerberos  Transited Services: -  Package Name (NTLM only): -  Key Length:  0  This event is generated when a logon session is created. It is generated on the computer that was accessed.'

**Phase 2: Completed decoding.
       decoder: 'windows'
       status: 'AUDIT_SUCCESS'
       id: '4624'
       extra_data: 'Microsoft-Windows-Security-Auditing'
       dstuser: 'WIN2K19$'
       system_name: 'win2k19.ad.lab.wafflelab.online'
       srcip: '::1'
       dstuser: '-  Account Domain:  -  Logon ID:  0x0  Logon Type:   3  New Logon:  Security ID:  S-1-5-18  Account Name:  WIN2K19$ '
       extra_data: '-  Logon ID:  0x0  Logon Type:   3  New Logon:  Security ID:  S-1-5-18  Account Name:  WIN2K19$  Account Domain:  AD.LAB.WAFFLELAB.ONLINE'

After:

**Phase 1: Completed pre-decoding.
       full event: '2020 May 22 18:48:00 WinEvtLog: Security: AUDIT_SUCCESS(4624): Microsoft-Windows-Security-Auditing: WIN2K19$: AD.LAB.WAFFLELAB.ONLINE: win2k19.ad.lab.wafflelab.online: An account was successfully logged on. Subject:  Security ID:  S-1-0-0  Account Name:  -  Account Domain:  -  Logon ID:  0x0  Logon Type:   3  New Logon:  Security ID:  S-1-5-18  Account Name:  WIN2K19$  Account Domain:  AD.LAB.WAFFLELAB.ONLINE  Logon ID:  0x8bde76  Logon GUID:  {5dad7a1a-1019-4313-85d1-4687ded0cc57}  Process Information:  Process ID:  0x0  Process Name:  -  Network Information:  Workstation Name: -  Source Network Address: ::1  Source Port:  59801  Detailed Authentication Information:  Logon Process:  Kerberos  Authentication Package: Kerberos  Transited Services: -  Package Name (NTLM only): -  Key Length:  0  This event is generated when a logon session is created. It is generated on the computer that was accessed.'
       hostname: 'arrakis'
       program_name: 'WinEvtLog'
       log: 'Security: AUDIT_SUCCESS(4624): Microsoft-Windows-Security-Auditing: WIN2K19$: AD.LAB.WAFFLELAB.ONLINE: win2k19.ad.lab.wafflelab.online: An account was successfully logged on. Subject:  Security ID:  S-1-0-0  Account Name:  -  Account Domain:  -  Logon ID:  0x0  Logon Type:   3  New Logon:  Security ID:  S-1-5-18  Account Name:  WIN2K19$  Account Domain:  AD.LAB.WAFFLELAB.ONLINE  Logon ID:  0x8bde76  Logon GUID:  {5dad7a1a-1019-4313-85d1-4687ded0cc57}  Process Information:  Process ID:  0x0  Process Name:  -  Network Information:  Workstation Name: -  Source Network Address: ::1  Source Port:  59801  Detailed Authentication Information:  Logon Process:  Kerberos  Authentication Package: Kerberos  Transited Services: -  Package Name (NTLM only): -  Key Length:  0  This event is generated when a logon session is created. It is generated on the computer that was accessed.'

**Phase 2: Completed decoding.
       decoder: 'windows'
       status: 'AUDIT_SUCCESS'
       id: '4624'
       extra_data: 'Microsoft-Windows-Security-Auditing'
       dstuser: 'WIN2K19$'
       system_name: 'win2k19.ad.lab.wafflelab.online'
       srcip: '::1'
       dstuser: '-'
       extra_data: '-'