fix(ocsf): make exported events valid and attributable

[krishicks]

Correct the OCSF fields emitted for API decisions and event identity.

Exported OCSF records are now schema-valid and can be reliably attributed. Gateway-origin records identify the configured gateway and emitting replica, while sandbox identity remains attached to the affected container and every event receives its own unique ID.

API activity records retain their action and disposition when consumed and re-exported. Events also include the required device classification and omit empty container or image objects instead of reporting misleading identities.

Summary

• Deserialize action_id and disposition_id on ApiActivityEvent so round trips preserve the recorded decision.
• Emit the schema-required device.type_id and its sibling label.
• Identify gateway-origin events as the gateway rather than the sandbox they concern. Emit the operator-assigned gateway name as device.name and the per-replica identity as both device.uid and hostname.
• Generate a distinct metadata.uid for each event, keep sandbox identity in container.uid, and omit empty container and image objects.

Related Issue

Refs #1055

Changes

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)