cisco_asa: fix handling of user parsing with sgt fields

[efd6]

What does this PR do?

This fixes handling of user parsing when there are SGT fields associated with the user and dissects the destination user from the domain in 302013 and 302015 events.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• [ ]

How to test this PR locally

Related issues

• Relates #[Filebeat][Cisco Module][ASA] Cisco ASA VPN logs ingest pipeline failure beats#32009

Screenshots

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2022-07-05T04:38:50.963+0000

• Duration: 16 min 13 sec

Test stats 🧪

Test	Results
Failed	0
Passed	29
Skipped	0
Total	29

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[elasticmachine]

🌐 Coverage report

Name	Metrics % (covered/total)	Diff
Packages	100.0% (1/1)	💚
Files	100.0% (1/1)	💚 3.529
Classes	100.0% (1/1)	💚 3.529
Methods	94.444% (17/18)	👍 5.136
Lines	63.842% (1130/1770)	👎 -27.1
Conditionals	100.0% (0/0)	💚