Harden SDK exporter transport and safety-rule execution

[manas-fortifyroot]

Summary

This PR hardens the FortifyRoot Python SDK across exporter transport handling, safety-rule execution, and vendoring provenance.

Changes include:

• Reject remote plaintext grpc:// and http:// OTLP export endpoints.
• Keep local plaintext export limited to localhost and loopback addresses.
• Use secure gRPC by default for bare host:port endpoints.
• Reject endpoint URLs containing username/password userinfo.
• Remove host.docker.internal from plaintext-local export and config-polling allowlists.
• Make regex safety rules require google-re2; stdlib regex fallback is not used for untrusted regex rules.
• Add error-level logging and metrics when regex-based masking is degraded.
• Stream regex matches lazily so MAX_REGEX_MATCHES bounds match materialization.
• Fix UDF detector opt-in so later init() calls restore the secure default.
• Add an observable error log and metric when startup proceeds with an empty safety snapshot after initial config-fetch failure.
• Update vendoring tooling so dirty local vendoring is marked honestly in VENDOR_MANIFEST.json.
• Re-vendor the updated fork through scripts/vendor.sh.

Security Notes

This PR reduces the risk of accidental plaintext telemetry export, bearer-token exposure, userinfo leakage, regex-related runtime DoS, and silent safety-mask degradation.

Validation

• poetry run pytest
• Focused safety/exporter/vendoring tests
• git diff --check
• Vendor manifest JSON validation
• System Tests.