ref(envelope): Introduce an item type for security reports

[jan-auer]

Introduces a separate item type for security events: ItemType::Security. This type allows for easy detection of security events without parsing the body. Other than that, it behaves exactly the same as ItemType::Event.

To create this item in event ingestion, the apply_to_event family of functions also sets the event type. The main processing function then uses this event type to create the appropriate item.

Raw security reports as submitted by the browser go into ItemType::RawSecurity. In ingestion, this item is parsed, transformed into a security event and then put into ItemType::Security.

Changelog (Internal): Security events (CSP, Expect-CT, Expect-Staple, and HPKP) are now placed into a dedicated security item in envelopes, rather than the generic event item. This allows for quick detection of the event type for rate limiting.

[jan-auer]

I'm not particularly proud about the changes in relay-general. Ideally, we would be able to infer the EventType without writing it into the payload. However, we need it even in external Relays, because otherwise they could not put it into the appropriate Envelope Item for forwarding.

@untitaker what do you think of this approach? Would you prefer something different?

[untitaker]

I think this is fine, I am not sure I understand the concern.

Ideally, we would be able to infer the EventType without writing it into the payload.

We have dedicated interfaces for each of the security types so this type of inference seems almost trivial? But honestly I don't care if we materialize the event type upfront

[jan-auer]

Moved the event type into relay-server now, so that it is closer to the requirement. There is a comment now describing why this is done.