feat: Add clientid to add-clientid-to-securityevents

[clouserw]

Because:

• It would be helpful to see relying parties associated with logs

This commit:

• Adds the client id when it is available

[Copilot]

Pull request overview

Adds optional client_id attribution to recorded security events so logs/metrics can be correlated with relying parties when the originating service is known and allowed.

Changes:

• Extend recordSecurityEvent to extract service from request payload/query, validate it against an allowlist (or legacy "sync"), and include it as additionalInfo.client_id.
• Emit client_id as a StatsD tag for AccountEventsManager.recordSecurityEvent write/error metrics when present.
• Add/update local tests to cover client_id inclusion/exclusion behavior and metric tagging.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
packages/fxa-auth-server/lib/routes/utils/security-event.ts	Extracts/validates service and attaches client_id into security event additionalInfo.
packages/fxa-auth-server/lib/account-events.ts	Adds optional client_id to security event additionalInfo type and tags StatsD metrics with it.
packages/fxa-auth-server/test/local/routes/utils/security-event.ts	Adds unit tests for recordSecurityEvent client_id allowlist behavior and request source precedence.
packages/fxa-auth-server/test/local/account-events.js	Updates/adds tests asserting StatsD tagging behavior for security events with/without client_id.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[dschom]

@clouserw Do you just want this info on security events and statsd metrics reported from security events? Or do you want client_id on logs and statsd metrics in general?

[clouserw]

@dschom I don't remember opening this PR 😬 I thought we filed an issue. But yes, everywhere would be ideal but anything is better than nothing.

[clouserw]

yeah, the real fix for this is #20213 . closing