fix(*): truncate json_content/json_map keys over 31 chars to match engine-stored keys

[bryant-smith]

Summary

• The engine's JSON_MAX_KEY_SIZE is 32 bytes, so Parse_JSON() (parsers/json.c) clips any dotted JSON key path over 31 chars before storing it. Both JSON_Content() (json-content.c) and the json_map lookup (Get_Key_Value, called from processors/engine.c) do an exact strcmp against that stored key, so a rule naming the real, untruncated field path never matches -- silently, with no error or log line.
• Confirmed live against a real Entra sign-in event and independently against the engine source (see quadrantsec/sagan#696, which documents the same root cause for a subset of these).
• Since the key names come from the log formats themselves (AWS CloudTrail, Entra, Confluent, Okta, Oracle OCI) and can't be shortened, this truncates each affected key to the first 31 chars -- the exact string the engine actually stores -- so all 28 affected rules match again. Each change carries a comment recording the original full key, so they're easy to restore if JSON_MAX_KEY_SIZE is ever raised.
• Two additional json_map rules (cisco-amp.rules, screenconnect.rules) target array elements and are not fixed here -- arrays are never expanded by the parser regardless of key length, so truncation doesn't help; they need a different rewrite.

Rules affected (28)

• azureEventHub_entra.rules -- 1 rule (2 keys)
• azure-eventhub-ad.rules -- 1 rule
• aws-cloudtrail.rules -- 1 rule
• okta.rules -- 1 rule
• confluent.rules -- 9 rules
• ddr.rules -- 7 rules
• gcp-cloud-audit.rules -- 5 rules
• oracle_oci.rules -- 1 rule

Test plan

• Verified truncation boundary empirically: a rule matching the real (34-char) .properties.deviceDetail.isManaged never fires against a live event containing that field; the same rule matching the truncated (31-char) .properties.deviceDetail.isMana fires correctly.
• Verified every edited rule line still has balanced quotes and correct trailing syntax.
• Recommend re-running each modified rule's normal test fixture/log sample before merge, since fixing a previously-dead rule may surface new alert volume.

🤖 Generated with Claude Code