fix(report): count all normalized authentication event types

[stacknil]

Summary

Add six missing entries to the report event counter: three sudo/su audit types, accepted and failed SSH keyboard-interactive, and SSH maximum-authentication-attempts. The counter now covers all 15 EventType entries, including the Unknown sentinel.

Why

Successfully parsed events could increase parsed_event_count while disappearing from event_counts. Refs #128.

Behavior change

Global and per-host JSON counts and global Markdown counts include those existing event types. Focused regressions exercise both input modes and a minimal two-host fixture.

Validation

Both regression stages failed before their corresponding additions and passed afterward. The Linux/GCC 13.3 warnings-as-errors build and complete CTest passed 7/7; git diff --check passed. A supplemental local CLI check verified count conservation for all 14 normalized types globally and per host. Windows/MSVC was not run locally; the Windows GitHub Actions job passed all seven CTest entries.

Compatibility

Detector eligibility and findings, parser/warning behavior, report schema/version, CSV, timestamps, and existing report goldens are unchanged. Consumers will see previously missing event-count rows and corrected totals. The production diff is six counter entries; no goldens were regenerated. Rollback is a revert of this commit.