Given a list of log lines, parse each line and return a summary of suspicious IPs and slow endpoints. Each log line has the format timestamp ip method path status latency_ms. An IP is suspicious if it has at least failed_threshold responses with status 401 or 403. A path is slow if its average latency is at least slow_threshold milliseconds. Return a dictionary with suspicious IPs sorted by descending failure count, and slow paths sorted lexicographically.
def analyze_logs(logs, failed_threshold, slow_threshold):