refactor: deduplicate OCSF builder setters and persistence helpers

[ericcurtin]

Summary

Eliminate three categories of repeated code identified across the codebase: OCSF event builder setter methods, a protobuf decode-and-hydrate block in the persistence layer, and mechanical enum-dispatch arms on the `Store` type.

Related Issue

N/A — proactive deduplication refactor.

Changes

`crates/openshell-ocsf/src/builders/` — six new `macro_rules!` macros in `mod.rs`:

• `impl_activity_setter!` — generates the `activity()` setter (applied to all 6 builders)
• `impl_action_disposition_setters!` — generates `action()` + `disposition()` (5 builders)
• `impl_actor_process_setter!` — generates `actor_process()` (4 builders)
• `impl_dst_endpoint_setter!` — generates `dst_endpoint()` (3 builders)
• `impl_src_endpoint_addr_setter!` — generates `src_endpoint_addr()` (network, ssh)
• `impl_firewall_rule_setter!` — generates `firewall_rule()` (network, http)

~55 hand-written, identical method bodies removed from `network.rs`, `http.rs`, `ssh.rs`, `process.rs`, `finding.rs`, and `lifecycle.rs`.

`crates/openshell-server/src/persistence/mod.rs`:

• Extract private `decode_record()` helper — the three-line decode + `set_resource_version` block was duplicated in `get_message`, `get_message_by_name`, `list_messages`, and `list_messages_with_selector`. Each method now uses `.map(decode_record).transpose()` or `.into_iter().map(decode_record).collect()`.
• Add `store_dispatch!` macro — eliminates the 13 identical `match self { Postgres(s) => s.method(...).await, Sqlite(s) => ... }` arms that covered every public method on `Store`.

Net: -93 lines (180 added, 273 removed across 8 files).

Testing

• `mise run pre-commit` passes
• `cargo test -p openshell-ocsf` — 120 tests pass
• `cargo test -p openshell-server` — all tests pass
• E2E tests added/updated (not applicable — no behavioral change)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[TaylorMutch]

/ok to test 1abffe6