Reconcile deny-event fields between extproc and proxy listeners

Each listener records different fields on an OnRequest deny:

• extproc.recordInboundReject sets Plugins, Identity, Duration.
• reverseproxy.recordInboundReject sets none of those; sets TLS instead (which extproc omits).
• Same split outbound (extproc vs. forwardproxy).

ref: https://github.com/rossoctl/cortex/pull/935#pullrequestreview-5171287832

Operators reading /v1/sessions see a different event shape depending on which listener served the request.

Fix

Delegate both recordInboundReject implementations to a single helper that populates the same fields from pctx. Then expand the parity suite's observation to cover Identity (fixture provisioning an identity catches further drift).

Found by the parity suite in #935; not caught by the current fixtures because Identity/TLS/Duration are excluded from observation and Plugins is empty on the deny fixture.

Start with extproc.recordInboundReject and reverseproxy.recordInboundReject, then compare the corresponding outbound implementations in forwardproxy and extproc. Trace the shared pctx fields and inspect the parity suite's observation fixture. Done means both listener paths expose matching Plugins, Identity, Duration, and TLS fields, with the expanded parity suite passing.