sshd-logs parser should match 'Connection closed by' lines even without 'invalid user'

[alacham]

On two different Debian Bookworm VPSs I have had ssh login attempts every 3 minutes.

But it's not matched, because it reads only:

# host 1
2024-11-18T03:58:49.732564-05:00 myhost1 sshd[1226287]: Connection closed by 118.27.24.104 port 48890 [preauth]
# host 2
Nov 19 22:58:24 myhost2 sshd[60765]: Connection closed by 118.27.24.104 port 49110 [preauth]

this PR should remediate it

fixes #1169

[alacham]

I came to look if it's merged yet and instead found that it's a duplicate of #1017