feat(ocsf): validate OCSF events against exported JSON Schemas (#5019)

* feat(ocsf): add JSON Schema validator for OCSF events

Add openshell-ocsf-validate, which validates an OCSF event against the
JSON Schema the OCSF schema server exports for the event's version,
class, and declared profiles. The exports encode required attributes,
at_least_one constraints, undefined attributes, types, and enum values,
so the crate delegates to the jsonschema crate and only selects the
schema. The exports type type_uid only as an integer, so the crate also
checks that it equals class_uid * 100 + activity_id.

An exported schema covers one fixed set of profiles, so the crate vendors
one export per class and profile combination that OpenShell emits, under
schemas/v<version>/<class>@<profiles>.json. An event whose version or
combination has no vendored schema fails with the schemas/update.sh
command that vendors it. Keying on the event's version lets a new OCSF
version's schemas land before the emitters switch to it. The build
embeds every vendored file.

Top-level container is accepted unvalidated, as OCSF does not define it
at the event level (#4915).

Signed-off-by: Kris Hicks <khicks@nvidia.com>

* test(ocsf): validate OCSF events with openshell-ocsf-validate

Replace openshell-ocsf's hand-written schema walker with
openshell-ocsf-validate in the builder, producer, gateway audit and
Podman e2e tests. One validate_event call now covers what the
per-object validate_required_fields, validate_known_fields and
validate_enum_value calls checked, and adds type checks and enum
checks for every attribute.

Remove the validation module and the vendored OCSF object and class
schemas from openshell-ocsf. The e2e suite no longer depends on
openshell-ocsf directly.

Signed-off-by: Kris Hicks <khicks@nvidia.com>

---------

Signed-off-by: Kris Hicks <khicks@nvidia.com>

Author: krishicks

.gitattributes

@@ -10,4 +10,4 @@ python/openshell/_proto/*_pb2.pyi linguist-generated
 crates/openshell-core/src/proto/openshell.*.rs linguist-generated
 
 # Vendored OCSF schemas fetched from schema.ocsf.io
-crates/openshell-ocsf/schemas/** linguist-generated
+crates/openshell-ocsf-validate/schemas/v*/** linguist-generated

AGENTS.md

@@ -35,6 +35,7 @@ Do not rely on this file for a full inventory. The detailed public and contribut
 | `crates/openshell-bootstrap/` | Gateway metadata | Gateway registration metadata, auth token storage, mTLS bundle storage |
 | `crates/openshell-gateway-interceptors/` | Gateway interceptors | Intercepts and transforms configured gRPC requests at the gateway routing boundary |
 | `crates/openshell-ocsf/` | OCSF logging | OCSF v1.8.0 event types, builders, shorthand/JSONL formatters, tracing layers |
+| `crates/openshell-ocsf-validate/` | OCSF validation | Test-time validation of OCSF events against vendored OCSF JSON Schemas |
 | `crates/openshell-otel/` | OpenTelemetry support | Shared OTLP trace provider, resource, and tracing-layer construction |
 | `crates/openshell-otel-test-support/` | OpenTelemetry test support | Shared loopback OTLP collector fixture for tracing tests |
 | `crates/openshell-crypto/` | Crypto backend | Backend-neutral primitives and TLS, PKI, JWT adapters; AWS-LC implementation |