feat(server): accept custom fields when filing a bug

[mimi1vx]

Second of the two PRs from the create-time discovery audit item (#74 was
the first). Single commit.

What

create_bug had a fixed parameter set and no way to carry cf_* values, so
a product with a mandatory custom entry field could not be filed into at
all — update_bug_fields already had the cf_* machinery (I7: only
cf_* keys may pass, otherwise the tool errors without calling Bugzilla),
so the create side was a gap, not a new mechanism.

create_bug now takes the same custom_fields param (JsonObject, same
doc wording as the updater) and applies the identical I7 prefix gate,
before may_create and before any upstream call, then merges the keys
into the create payload. The early error here is safe to make
distinguishable even though the create refusal is otherwise padded and
uniform: its outcome is a pure function of the client's own key names, not
of policy or upstream state, so it discloses nothing about either.

Confirmed no policy::Matcher criterion reads cf_* — a custom field
cannot move a prospective bug between rules the way product/component
can — and pinned that down with a new guard test alongside the existing
create-time reclassification tests.

Invariants touched

• I7 — amended to name both update_bug_fields.custom_fields and
  create_bug.custom_fields, and to record that the create-side gate runs
  before may_create with zero upstream requests on refusal.
• I8/create refusal padding — unaffected; the cf_* gate is a
  separate, deliberately distinguishable early error, not a substitute for
  the padded policy/upstream refusal.

Verification

• cargo fmt --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo clippy -p bugwarden --features gen --all-targets -- -D warnings
• cargo test --workspace --all-targets --locked — all green, including:
  • crates/bugwarden-core/src/guard.rs: new unit test asserting the
    create verdict is unchanged by a cf_* value, for both an allowed and
    a policy-denied product.
  • crates/bugwarden/tests/tools_wiremock.rs: a cf_* key reaches the
    POST /rest/bug body; a non-cf_ key errors with the exact I7 text
    and makes zero upstream requests.
• cargo deny check — clean (no new dependencies).