fix(logging): retain default window for incidental timestamp text

[AliAbouelazm]

Fixes #17338.

The default 24-hour window was skipped whenever a filter contained timestamp, including JSON field names, labels, and quoted text. This change recognizes the actual timestamp field while keeping strings, escaped quotes, nested paths, and comments separate.

Existing timestamp comparisons and documented cast(timestamp, ...) expressions keep their behavior. Appended defaults also stay outside trailing comments, and comment-only filters receive a valid time constraint.

Validation:

• 1,385 unit tests and 61 subtests pass on Python 3.12 and 3.14 with both protobuf implementations.
• The changed helper has 100% statement and branch coverage. Aggregate coverage remains above the current 99% CI threshold and does not decrease from the baseline.
• Ruff import/format checks, Flake8, setup metadata validation, package build, and Twine checks pass.
• All tests ran offline. No live Google Cloud calls or resources were used.

No documentation change is needed because this restores the documented default time window.

[gemini-code-assist]

Code Review

This pull request refactors the _add_defaults_to_filter helper in google-cloud-logging to use a regular expression-based tokenizer (_FILTER_TOKENS) for parsing logging filters. This ensures that default timestamp constraints are only skipped when there is an actual comparison or cast on the timestamp field, avoiding false positives from occurrences inside strings, comments, or other field paths. It also adds comprehensive unit tests to verify these scenarios. Feedback suggests handling empty or whitespace-only filters to prevent generating invalid filter strings starting with AND.