Add enable_debug_observability scanner feature flag

[vinckama]

What does this PR do?

Adds a new enable_debug_observability feature flag (default: false) to the scanner. When enabled, the false_positive.multipass.excluded_match metric is emitted with an additional sds_namespace tag containing the JsonPath-formatted path where the false positive was found.

This is motivated by a support investigation where matches were silently discarded by the multipass v0 exclusion logic and it was impossible to tell from existing metrics which attribute was responsible. The flag allows operators to enable the extra tag per-org on demand for debugging, without incurring high-cardinality metric series in production.

Jira: SDS-2471

Changes

• ScannerFeatures.enable_debug_observability defaults to false — no behavior change for existing callers
• RuleMetrics stores base_labels only for use on the debug path; the fast path continues to use the pre-initialized Counter with no allocation
• Go layer: CreateScanner is unchanged (delegates to CreateScannerWithOptions with zero-value options), fully backward compatible
• New test should_submit_excluded_match_metric_with_debug_observability verifies the metric is emitted with the sds_namespace label when the flag is on

[fuchsnj]

I'm not sure if we want to start supporting this kind of debug logic, when the "intended" way to debug this is the new debug_scan endpoints. Ideally during a support investigation we could initiate a "debug scan" for an existing log and get more detailed information (which would indicate multipass-v0 matches). The UI for this isn't available though, so this is a reasonable temporary solution.