fix: level detection for warning level (backport k223)

[loki-gh-app]

Backport 242a852 from #14444

---

What this PR does / why we need it:

Error detection is not correctly identifying "warning" level in structured (ie. json or logfmt) logs, which causes it to fall through to detecting by log line content, in which case a string like "error" or "info" will be used instead of the correct log level.

Which issue(s) this PR fixes:
Fixes #14443

Special notes for your reviewer:

Checklist

• Reviewed the CONTRIBUTING.md guide (required)
• Documentation added
• Tests updated
• Title matches the required conventional commits format, see here
  • Note that Promtail is considered to be feature complete, and future development for logs collection will be in Grafana Alloy. As such, feat PRs are unlikely to be accepted unless a case can be made for the feature actually being a bug fix to existing behavior.
• Changes that require user attention or interaction to upgrade are documented in docs/sources/setup/upgrade/_index.md
• If the change is deprecating or removing a configuration option, update the deprecated-config.yaml and deleted-config.yaml files respectively in the tools/deprecated-config-checker directory. Example PR