dotCMS Cloud request-cost pipeline: multi-cloud support and attribution

Parent

Part of #32886 (per-request-cost accounting).

Summary

Adds cloud-provider attribution and enforced TLS to the request-cost telemetry pipeline (RequestCostPublisher → OVH token-collector → telemetry_request_cost), which has been running for OVH-hosted instances for some time and is the data source for the Q3 Profitability/PLG rock's per-cloud cost comparison.

Full design: ADR-0022 (dotCMS/platform-adrs) and the companion implementation plan, docs/plan-request-cost-provider-attribution.md on branch worktree-ovh-k8s-cluster+request-cost-provider-attribution in dotCMS/ovh-k8s-cluster.

Why

Two gaps found while scoping the rock's "configurable per backend (AWS/OVH/GCP + Azure)" requirement:

1. RequestCostPublisher only warns (doesn't refuse) if its push URL isn't https://.
2. telemetry_request_cost has no cloud-provider column, and cluster_id doesn't reliably encode which cloud a row came from.

A security review of token-collector's actual auth code found that trusting a client-supplied provider field (the original design) would let any write-token holder mislabel their own provider, corrupting the profitability dataset — so provider is derived from which write token authenticated the request, not anything the client sends. See ADR-0022 for full rationale, alternatives considered, and risk analysis.

Sub-issues

• Enforce HTTPS-only in RequestCostPublisher (dotCMS/core)
• Migrate telemetry_request_cost: add native cloud_provider column (dotCMS/ovh-k8s-cluster)
• Token → provider map in auth.ts + rename WRITE_TOKEN → WRITE_TOKEN_OVH (dotCMS/ovh-k8s-cluster)
• Validator hardening: length caps + missing write-path tests (dotCMS/ovh-k8s-cluster)

Out of scope

• Building an AWS, GCP, or Azure publisher/collector — tracked separately (see sibling epic in dotCMS/infrastructure-as-code for the AWS/Evergreen side, which uses a different mechanism — response headers, not this push pipeline).
• Any billing-system integration.

Start with RequestCostPublisher in dotCMS/core and read ADR-0022 for the provider-attribution design and TLS requirement. Then review the listed implementation points, including telemetry_request_cost, auth.ts, WRITE_TOKEN_OVH, and validator tests. Done means all four sub-issues are addressed without adding the out-of-scope publishers or billing integration.