feat(auth): emit OCSF events for credential-less gateway requests

[krishicks]

Summary

The gateway now emits an OCSF Authentication [3002] event when it rejects a gRPC request before consulting any authenticator. This is the first of several PRs for #2912: it adds the Authentication event class and emits it for the rejections the router makes on its own.

Related Issue

Refs #2912

This is one of several PRs that together satisfy #2912, so it does not close the issue. The remaining work is listed under Follow-ups.

Changes

• Events: AuthGrpcRouter emits an Authentication failure event for three rejections. The response returned to the caller is unchanged.

  Rejection	status_detail	Protocol	Severity
  No credential and no fallback principal	missing_credential	—	Low
  mTLS required, no client certificate	missing_credential	mtls	Low
  Operator certificate plus authorization header	conflicting_credentials	mtls	Medium

  No identity is established in these cases, so user is a fixed placeholder, {name: "unknown", type_id: 0}. Events never include presented credentials or headers.

• openshell-ocsf:

  • Adds the Authentication event and builder, User and Service objects, AuthProtocolId and UserTypeId enums, shorthand output (AUTH:LOGON ...), and vendored 1.8 schemas for authentication, user and service.
  • A known schema protocol always carries its schema caption; custom labels require auth_protocol_other(), which records 99 Other.
  • Adds test_support::OcsfCapture, a tracing layer that records the OCSF events emitted during a test. It replaces the test-local ProbeLayer in service_routing.rs.

• Schema validation: validate_known_fields rejects attributes the class doesn't define, and profile attributes whose profile metadata.profiles doesn't declare.

  • It caught two problems in this event while I was building it. api on Authentication belongs to the cloud profile, so the gRPC method goes in http_request.url.path instead. The top-level container attribute is invalid in every OCSF version, so this builder omits it.
  • Existing builders still emit the top-level container. Fixing them is separate work.

• Docs: logging.mdx and ocsf-json-export.mdx get the AUTH: / 3002 class rows, a shorthand example, and a note on the reason categories.

Follow-ups

Later PRs for #2912 will add:

• reason categories for credentials the authenticators reject (invalid, expired, stale identity);
• the peer address and request correlation ID;
• authorization-denial API Activity events, with Detection Findings for sandbox principals crossing their boundary.

device.os.type_id is missing from every OpenShell event and will be fixed separately.

Testing

• cargo nextest run on openshell-ocsf and every crate that depends on it: 4361 passed. One environment-dependent proxy test failed twice, then passed on main, on this commit in a separate checkout, and three times on rerun here.
• Clippy with -D warnings on every target in rust:lint (workspace, sandbox perf-harness, e2e, two examples)
• cargo check --workspace --all-targets
• Unit tests added: router tests for each rejection (event fields, schema validity, unchanged status, credential canary, no event on success or health checks), builder schema tests, shorthand, round-trip, and OcsfCapture
• Docs validation not run

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-4632.docs.buildwithfern.com/openshell