RHCLOUD-48760: Add SEC-MON-REQ-1 security logging

[platex-rehor-bot]

What?

Implements SEC-MON-REQ-1 security logging compliance for the Payload Tracker service (RHCLOUD-48760).

Why?

SEC-MON-REQ-1 requires structured security logging for Events of Interest (EOI) to meet compliance requirements.

How?

New internal/securitylog package with structured helpers using logrus. All security events include the 5 required fields: action, resource_type, resource_id, outcome, and principal (org_id, user_id, type). Events are marked with security_event: true for log aggregation.

Covered EOI categories:

• EOI-5 (Lifecycle): STARTUP/SHUTDOWN events for both pt-api and pt-consumer binaries
• EOI-7 (Authentication failures): Missing, invalid base64, or malformed identity headers in checkForRole
• EOI-8 (Authorization failures): Required role not found in associate identity
• Data access: Successful archive link retrieval (the only auth-protected endpoint)

Excluded (with justification):

• EOI-1 CRUD on read-only API endpoints (all GET, high-volume, no mutations)
• EOI-4 (no RBAC system beyond role check)
• EOI-6 (authentication handled upstream)

Also adds graceful shutdown signal handling to pt-api so SHUTDOWN events are reliably captured.

Testing

• 10 new unit tests for securitylog package (principal extraction, log output verification)
• All 31 existing endpoint tests pass
• Build verified: make build-all succeeds

Anything Else?

Principal extraction supports User, Associate, and ServiceAccount identity types from the x-rh-identity header. The package follows the same pattern used in other SEC-MON-REQ-1 implementations across the platform (insights-ingress-go, export-service-go, chrome-service-backend).

Secure Coding Practices Checklist Link

• https://github.com/RedHatInsights/secure-coding-checklist

Secure Coding Checklist

• Input Validation
• Output Encoding
• Authentication and Password Management
• Session Management
• Access Control
• Cryptographic Practices
• Error Handling and Logging
• Data Protection
• Communication Security
• System Configuration
• Database Security
• File Management
• Memory Management
• General Coding Practices