Tag drop{} statements per content-hub convention

Google's content-hub parsers tag dropped logs (drop { tag => "TAG_..." })
so they surface correctly in the unparsed-log views, rather than bare drop{}.
Use TAG_MALFORMED_ENCODING for the two JSON-extraction/parse failures (matches
content-hub) and TAG_UNSUPPORTED for valid JSON that matches no parsedmarc
report shape.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: seanthegeek

google_secops_parser/parsedmarc.conf

@@ -177,15 +177,15 @@ filter {
     on_error => "no_json_payload"
   }
   if [no_json_payload] {
-    drop {}
+    drop { tag => "TAG_MALFORMED_ENCODING" }
   }
 
   json {
     source => "payload"
     on_error => "not_json"
   }
   if [not_json] {
-    drop {}
+    drop { tag => "TAG_MALFORMED_ENCODING" }
   }
 
   # ---------------------------------------------------------------------------
@@ -232,7 +232,7 @@ filter {
 
   # Not a parsedmarc record we recognize: drop rather than emit an invalid event.
   if [report_type] == "" {
-    drop {}
+    drop { tag => "TAG_UNSUPPORTED" }
   }
 
   # ===========================================================================