Add enhanced session and authentication audit bindings

[arkmish]

Description

Add session and authentication context to enhanced audit logging so consumers can follow valid connection attachments, reconnects, and authentication changes without rewriting the identity recorded on earlier writes.

Two operations are emitted:

Operation	Meaning
sessionEstablished	A valid session attachment, including reconnect or movement to another server
authentication	An actual explicit-auth or completed SASL authentication outcome

Each record pairs one sanitized scalar user with its auth_scheme. Distinct bindings are emitted separately; duplicate sanitized pairs within one hook are collapsed.

• Emit only after valid session assignment or an actual authentication outcome, never for an intermediate SASL challenge.
• Leave unassigned session IDs and unknown principals absent. Failed authentication is not attributed to an identity from an earlier successful authentication.
• Reuse conservative identity sanitization, a consistent enhanced-mode decision, and best-effort error reporting.
• Preserve request-time write identities and all existing authentication, connection-close, and SASL-policy behavior.

These records are binding observations, not unique authentication-attempt or new-session counters. X509 or super identity is not evidence of TLS.

Tests

Validated SessionAuthAuditTest together with existing audit, auth, X509, SASL, TTL, DataTree, and metrics regression tests on JDK 11 targeting Java 8 APIs:

Tests run: 129, Failures: 0, Errors: 0, Skipped: 0
BUILD SUCCESS

Coverage includes real standalone/quorum session movement, real DIGEST-MD5 exchanges, synthetic X509/provider cases, scalar escaping, feature gates, mode changes, identity changes after attachment, and failing audit/reporting backends.

Live TLS transport, a Kerberos KDC, and production log delivery were not qualified by these tests.

• Local code review completed

Changes that Break Backward Compatibility (Optional)

Bindings require both zookeeper.audit.enable=true and zookeeper.audit.enhanced.enable=true; default and legacy-mode behavior are unchanged.

No authentication/TLS policy, ACL decision, or client protocol change. Consumers must handle per-identity event cardinality and unknown attribution. Strict schema consumers need updating before additive producer fields are enabled.

Documentation (Optional)

Updated zookeeper-docs/src/main/resources/markdown/zookeeperAuditLogs.md with binding fields, examples, identity/cardinality semantics, privacy, and consumer compatibility requirements.

🤖 Generated with GitHub Copilot CLI