Feat: Enrich tracing of proxy-server

[sfc-gh-pkowalewski]

Summary

Enriches proxy server traces with domain-specific span attributes and events so that a single trace in Tempo tells you who called, what targets were fanned out to, and how each target stream progressed, without needing to cross-reference logs.
Adds a proxy.target{/FullMethod} child span per backend connection and a proxy.target.dial sub-span for the dial+stream-creation phase, giving per-target latency breakdown within a fan-out.
All instrumentation is zero-cost when no TracerProvider is configured (OpenTelemetry noop behavior). No new dependencies , go.opentelemetry.io/otel packages already in go.mod.

Also, updated golangci to v2, as v1 is incompatible with go1.26.0

What's new

Root span enrichment (dispatch)

Attribute	Description
sansshell.caller.principal	Authenticated caller identity
sansshell.caller.address	Caller network address
sansshell.caller.groups	Caller group memberships
sansshell.caller.cert.cn	Client certificate Common Name
sansshell.caller.cert.spiffe_id	Client certificate SPIFFE ID
sansshell.proxy.justification	Request justification from metadata
sansshell.proxy.target_count	Total number of target streams opened
Event: dispatch.start_stream (once per target, carries sansshell.target.address and sansshell.target.method).

Per-target child span (proxy.target{/service/Method})

Attribute	Description
sansshell.target.address	Backend host:port
sansshell.target.method	Full gRPC method name
sansshell.target.stream_id	Mux stream ID
sansshell.target.stream_type	unary / server_stream / client_stream / bidi
sansshell.target.authz_dry_run	Whether this is a dry-run authz check
sansshell.target.dial_timeout_ms	Dial timeout (when configured)
sansshell.target.proxied_principal	Forwarded caller principal

Events on this span:

Event	Attributes	When
stream.connected	—	Dial succeeded, gRPC stream is open
stream.first_response	—	First RecvMsg from backend
authz.evaluated	sansshell.authz.result, sansshell.authz.method	After each per-message authz check
stream.finished	grpc.status_code	Stream completed

Dial sub-span (proxy.target.dial)

Wraps DialContext + NewStream. Records errors and status on dial/stream-creation failure.