fix(ocsf): emit schema-conformant OCSF events and honest downgrades

Native events failed the official OCSF 1.8.0 validator: device.os lacked
type_id, HTTP Activity emitted is_src_dst_assignment_known, sandbox
Process Activity events had no actor, and connection_info lacked
direction_id. Schema tests missed these because they checked only
top-level, non-profile attributes. The 1.1 and 1.3 downgrade stripped
three fields by name and relabelled events that did not conform.

Add OS type and connection direction enums, require an actor on Process
Activity at compile time, set hostname on domain endpoints, and make
schema validation recurse into nested objects, reject undefined
attributes, and honour declared profiles.

Make the downgrade schema-driven from definitions generated from the
vendored official 1.1.0 and 1.3.0 schemas: undefined attributes move
under unmapped.downgraded_attributes, unsupported profiles are dropped,
and an event is labelled with the target only when every requirement
holds. Otherwise it stays at native 1.8.0 and is counted by the gateway
metric openshell_ocsf_log_kept_native_total and a supervisor warning.
Top-level container stays unchanged pending a decision on #4283.

Closes #4283
Closes #4284

Signed-off-by: Adel Zaalouk <azaalouk@redhat.com>

Author: zanetworker