[mostafa]

Stacked on #616; merge that first.

Fixes #581.

OTLP log ingestion (POST /v1/logs and the gRPC LogsService) decodes untrusted protobuf into ExportLogsServiceRequest and converts it with logs_request_to_raw_events, but it was the only untrusted input surface without a cargo-fuzz target. Its stack-depth protection also came implicitly from prost's RECURSION_LIMIT of 100, which nothing in the repo pinned.

Changes

• New fuzz target fuzz_otlp_logs_decode: decodes arbitrary bytes as ExportLogsServiceRequest and, on success, converts the request and asserts every event payload is valid JSON. It runs in the weekly fuzz workflow with a 64 KiB max_len.
• Seed corpus in fuzz/seeds/fuzz_otlp_logs_decode/: a basic request, multiple resources, every AnyValue variant, a kvlist body, many attributes, an empty and a truncated message, and nesting just inside and past the prost limit.
• fuzz/Cargo.toml enables the otlp feature on rsigma-runtime and adds prost; fuzz/Cargo.lock only gains packages.
• Docs: the harness inventory in developers/fuzzing.md and the OTLP row of the parser table in reference/security.md.

Tests

• protobuf_decode_bounds_any_value_nesting decodes and converts a request with 45 nested array values, and asserts that 200 nested values fail to decode with prost's recursion-limit error. With prost/no-recursion-limit enabled it fails, so a dependency that turns the limit off breaks the build.
• A local 120-second ASan run of the new target (410,830 executions) found no crash.