Add opt-in write-size and outcome audit metadata

[arkmish]

Description

Make audit records useful for diagnosing large writes and failed or rolled-back mutations without changing the client's operation result.

Enhanced logging adds schema_version=2, attempted data_length, known error_code, transaction identifiers, and an explicit outcome of committed, failed, rolled_back, or unknown.

• Decode the correct request type for create variants, including TTL creates, and setData; retain the original request buffer's position, limit, and mark.
• Correlate multi members by their position in the full request, including checks and repeated paths. Use the final returned path for successful sequential creates.
• Determine whole-multi failure before classifying members, so a rolled-back member with error code zero is never logged as committed.
• Escape v2 fields reversibly, sanitize untrusted user/ACL identities, and never emit payload values. One captured mode governs sanitization and formatting throughout an operation.
• Keep audit sink and error-reporting failures from changing valid writes or interrupting system ephemeral deletions. Expose observed failures through a bounded audit_errors counter.

Enablement requires both zookeeper.audit.enable=true and zookeeper.audit.enhanced.enable=true. Both default to false.

Tests

Validated AuditHelperTest, AuditEventTest, StandaloneServerAuditTest, Slf4JAuditLoggerTest, CreateTTLTest, ServerMetricsTest, DataTreeTest, and AuthUtilTest on JDK 11 with Java 8 API targeting:

Tests run: 85, Failures: 0, Errors: 0, Skipped: 0
BUILD SUCCESS

Coverage includes real write results, atomic multi rollback, payload-size boundaries, typed TTL handling, buffer preservation, custom-provider redaction, logger/counter failures, and deterministic mode changes during emission.

• Local code review completed

Changes that Break Backward Compatibility (Optional)

Default audit output and existing public logging overloads are preserved. Enhanced mode is opt-in and adds versioned fields and conservative identity redaction; consumers must be prepared before it is enabled.

No authentication/ACL decision, client response, persistence-format, or ordinary-read auditing change. committed describes transaction application, not client delivery. The error counter cannot detect silent asynchronous-appender or downstream log loss.

Documentation (Optional)

Updated zookeeper-docs/src/main/resources/markdown/zookeeperAuditLogs.md with fields, escaping, operation/outcome semantics, privacy requirements, rollout guidance, and coverage limits.

🤖 Generated with GitHub Copilot CLI