Replace the silent unwrap_or_default() on the ReDoS evaluation timeout
with an explicit, per-rule timeout that logs a warn! carrying the
rule's identity instead of quietly folding a timed-out evaluation into
"no match". The per-rule evaluation now runs on a blocking-pool task so
the timeout can actually preempt a slow synchronous evaluation, rather
than racing a timer a non-yielding future would never let fire; a
timed-out rule is documented and logged as non-matching, and the rest
of the batch still runs.
Add DEBUG rule-fire logging (rule id/name + action kinds, never the
destination data an action carries) and INFO on reload_rules. Wrap
webhook dispatch in a tracing span logging the target host, and log
every SSRF/CIDR/DNS-rebind block decision as warn! with host/blocked-ip
and reason; allowed egress logs at debug. No message bodies, secrets,
or full URLs are logged.
Refs #360
James Maes