feat(discovery): report configured scope in metadata

[mayankpande88]

Description

The server knows a discovery datasource exists but not what it covers.

Checking the live dev database, the auto-registered integration for our testbed collector carries only routing information:

agent_type       proxy
connection_mode  vm_agent
datasource_key   local:aws-testbed

allowed_cidrs lives in the agent's local config and is never reported, so nothing server-side knows which ranges that collector is responsible for.

Why it matters before the scheduler lands

A scheduler cannot be built on this. nudgebee-enterprise#35405's scheduler has to know which CIDRs to sweep. Configured separately from the agent, the two drift: the server asks for a sweep the agent refuses as out of scope, and that refusal reads as a bug in discovery rather than a configuration mismatch. Someone will lose an afternoon to it.

The coverage report has no denominator. "412 machines, 32 gaps" requires the intended scope. Without it the server only knows what happened to answer, which is the difference between an inventory and a guess — and that report is the entire deliverable of this phase.

What this does

Adds allowed_cidrs to CollectMetadata, the same way #129 added pack_versions — the channel already exists, so this is a small addition rather than new plumbing.

An unrestricted datasource omits the field rather than reporting an empty list, so the server can distinguish "covers everything" from "covers nothing". Those need different handling and an empty list conflates them.

Bare hostnames in the allowlist are reported as configured, since they are resolved per request rather than at configure time and there is no address to report.

Refs #113, #114

Type of change

• Enhancement (non-breaking change which improves existing functionality)

How Has This Been Tested?

• Unit tests

make validate passes, lint clean, discovery at 80.1% coverage.

• A datasource configured with a CIDR, a bare IP and a hostname reports all three, with the bare IP normalised to /32 so the server sees consistent notation
• An unrestricted datasource omits the field entirely rather than reporting []
• Existing pack_versions and actions metadata tests still pass, so nothing else in the payload shifted

Not yet consumed server-side — that belongs with #35405, which is where the scheduler and the coverage report get built. This is the agent half, done first so the server work has something to read.

Checklist

• CLA signed (the CLA bot will prompt on your first PR)
• make validate passes (fmt + lint + test)
• Docs updated if the wire shape, config surface, or proxy module behavior changed

[gemini-code-assist]

Code Review

This pull request introduces a scope method to the Proxy struct to collect and report allowed CIDRs and hostnames as allowed_cidrs in the metadata. It also adds unit tests to verify this functionality. The review feedback suggests improving the test assertions in TestCollectMetadata_ReportsScope by using a map for exact lookups instead of string containment checks to avoid false positives.