Consider case when optional log fields may be missing in third_party_apps_tests.

[franciscovalentecastro]

Description

Currently constructQuery doesn't consider the case where an optional log field may be completely missing (see missing fields in log query language).

When vault was upgraded from 1.17.2 to 1.17.3, the field jsonPayload.auth is omitted when token_type=default. See hashicorp/vault@v1.17.2...v1.17.3 . Setting jsonPayload.auth as optional due to this update.

Related issue

b/358355216

How has this been tested?

Checklist:

• Unit tests
  • Unit tests do not apply.
  • Unit tests have been added/modified and passed for this PR.
• Integration tests
  • Integration tests do not apply.
  • Integration tests have been added/modified and passed for this PR.
• Documentation
  • This PR introduces no user visible changes.
  • This PR introduces user visible changes and the corresponding documentation change has been made.
• Minor version bump
  • This PR introduces no new features.
  • This PR introduces new features, and there is a separate PR to bump the minor version since the last release already.
  • This PR bumps the version.

[igorpeshansky]

LGTM