otel daemon: protobuf-encoded OTLP payloads bypass the identity-forgery strip (issue #268 follow-up)

Follow-up from PR #290's round-2 review (finding on `otel_daemon/normalize/mod.rs:89`).

## The gap

`normalize::stamp` strips `FORGEABLE_IDENTITY_KEYS` (`user.id`, `user.email`, `user.name`, `account_id`, `api_key_id`, `azp`) from client-supplied OTLP attributes before forwarding — but only for JSON bodies. A protobuf-encoded body is passed through `Ok(body.to_vec())` unchanged (see the module's ⚠️ doc note), so an attacker who can reach the loopback port and speaks OTLP/protobuf instead of JSON bypasses the whole identity-forgery defense: the same `user.id`/`account_id` spoofing the JSON strip closes, just on the other wire format. The governed collector's ingest handler (`lightbridge-authz-usage/src/handlers/ingest.rs`) trusts these attributes with no credential-derived override, regardless of wire format.

## Decision (2026-09-04)

Discussed against the real tradeoff:
- **(a) Refuse/quarantine protobuf** until a decoder exists — reverses #290's round-1 F1 fix (protobuf passthrough) and would silently break any exporter that defaults to protobuf.
- **(b) Leave the documented gap** — honest disclosure, but permissive by default on a security-relevant path.
- **(c) Build a real protobuf attribute strip/decoder** — closes it properly, nontrivial scope.

Chose **(b) for now**: round-2 of #290 ships with the gap disclosed in `normalize/mod.rs`'s module doc rather than blocking on a decoder or reverting protobuf passthrough. This issue tracks doing **(c)** as real follow-up work: parse `resourceMetrics`/`resourceLogs` out of the OTLP protobuf wire format (likely via `prost` + the OTLP proto definitions), strip `FORGEABLE_IDENTITY_KEYS`-equivalent fields, re-encode, mirroring what `normalize::stamp_resource` already does for JSON.

## Scope

- Add a protobuf OTLP decode/encode path (probably `prost`-generated types from the OTLP proto files) to `otel_daemon/normalize`.
- Extend `stamp` to route protobuf bodies through the new strip instead of the current unconditional passthrough.
- Test coverage mirroring `normalize/tests.rs`'s existing forged-attribute JSON tests, with a protobuf-encoded fixture.

Related: #268, PR #290.