feat: owasp security event logging for user, password, and shutdown events

[blackboxsw]

Delta above #6800 to aid in reviewing. Review top-most commit only for this PR.

Proposed Commit Message

    feat: owasp security event logging for user, password, and shutdown events
    
    Add a security event logging subsystem following the OWASP
    Logging Vocabulary Cheat Sheet.  Events are emitted as JSON Lines on a
    new SECURITY log level which is routed to a separate log file
    (default: /var/log/cloud-init-security.log).
    
    Add cloudinit/log/security_event_log.py which provides:
    - OWASPEventType / OWASPEventLevel enums for standardised event strings
    - Four decorators consumed by Distro methods:
      sec_log_user_created, sec_log_password_changed,
      sec_log_password_changed_batch, sec_log_system_shutdown
    
    cloudinit/log/loggers.py now has a custom SecurityFormatter that injects
    an ISO-8601 timestamp into log records.
    
    Apply decorators to the Distro class, and prevent subclassing of
    decorated methods.
    
    Use _get_elevated_roles helper exposes sudo/doas membership to the decorator.

Additional Context

Test Steps

make deb
CLOUD_INIT_KEEP_INSTANCE=1 CLOUD_INIT_CLOUD_INIT_SOURCE=cloud-init-base_26.1-19-g8eafe51b-1~bddeb_all.deb  CLOUD_INIT_OS_IMAGE=resolute tox -e integration-tests --tests/integration_tests/modules/test_combined.py::TestCombined::test_security_logs

Merge type

• Squash merge using "Proposed Commit Message"
• Rebase and merge unique commits. Requires commit messages per-commit each referencing the pull request number (#<PR_NUM>)