test(ocsf): validate enum ranges, scalar types, and class identifiers in schema tests #4596

User Story

I maintain OpenShell's OCSF conformance work (#4288) and ship OCSF output to SIEMs. I need the in-repo schema tests to catch the same classes of error the official OCSF validator does, so conformance regressions fail CI instead of reaching users.

Description

openshell_ocsf::validation::validate_required_fields checks attribute presence, nested required attributes, at_least_one constraints, profile-gated requirements, and undefined attributes. It does not check:

• enum ranges (validate_enum_value covers only device.type_id);
• scalar types (for example a string where an integer is defined);
• class_uid, category_uid, and type_uid consistency with the class schema (type_uid = class_uid × 100 + activity_id).

An out-of-range or wrong-for-class enum therefore passes the in-repo tests. Builder samples and real Podman supervisor JSONL currently pass the official validator, which does check enums, so this is a test-depth gap rather than a known defect.

Context

Raised by @rhuss in the #4288 review. The validator is used by the every-builder conformance test, the downgrade property test, the ocsf_jsonl_conformance Podman E2E test, and producer tests in other crates, so all of them gain the stricter checks.

Definition of Done

• The validator checks enum values and scalar types for every attribute it visits, recursively, against the vendored schema for the record's version.
• The validator asserts class_uid, category_uid, and type_uid consistency.
• Regression tests show an out-of-range enum, a mistyped scalar, and an inconsistent type_uid each fail validation.
• Existing builder, downgrade, producer, and E2E conformance tests pass, or the emitter defects they surface are fixed.