fix(dlp): scan tool_use.input and tool_result.content for secrets

[Destynova2]

Summary

Closes the DLP audit gap on chained tool calls. Previously the engine scanned only top-level message text, so secrets that flow through tool_use.input (tool arguments) or tool_result.content (tool output that flows back into the next provider call) were invisible — chained agent loops could quietly leak secrets across turns.

• New DlpEngine::sanitize_tool_io_request walks every tool_use.input (serde_json::Value, serialised) and every tool_result.content (string OR array of content blocks) in the request. Default mode rejects the request and emits a ToolIoBlocked audit entry; [dlp] mode = "redact" redacts in-place and continues.
• New DlpEngine::sanitize_tool_io_response does the same for the upstream provider response, so a model that echoes a leaked secret into a tool argument is caught before the response leaves the proxy.
• New DlpBlockError::SecretInToolIo { stage, tool_name, reason } — stage is "input" (request tool_use.input), "result" (request tool_result.content), or "output" (upstream-response tool_use.input).
• New AuditEvent::ToolIoBlocked variant; the existing dlp_rules_triggered field carries stage=…, tool=…, and the rule name.
• New ProviderLoopAction::DlpBlocked propagates upstream-response blocks past the provider fallback cascade (no sibling retry on a poisoned response).
• New [dlp] mode = "block" | "redact" config (default block).
• New grob_dlp_tool_io_total{stage,rule,outcome} metric.

Honors existing [dlp] enabled / scan_input / scan_output flags.

Test plan

• dlp_blocks_secret_in_tool_use_input
• dlp_blocks_secret_in_tool_result_content (covers the array-of-content-blocks branch)
• dlp_blocks_secret_in_upstream_response_tool_use_input
• dlp_redacts_when_mode_redact_in_tool_input (asserts the raw token does not survive in the serialized request)
• dlp_audit_log_records_tool_io_block (round-trips the new variant through the signing pipeline)
• dlp_passes_clean_tool_io_unchanged (byte-for-byte unchanged on clean input/result/output)
• cargo fmt --check, cargo clippy --all-targets --all-features -- -D warnings, cargo nextest run --tests --all-features (1307 tests, all green)