Test: cts-lab: improve log type detection

Searching "for k in LogKind" did not make sense since we don't want to include
ANY as a possible type to replace ANY with.

Search the systemd journal only if the nodes use systemd.

Search the systemd journal before the syslog, since if a node has both, syslog
likely just pipes from the journal with additional overhead and rate limiting.