Add a feature that transmits boundary audit logs from workspaces to coderd
via the agent API, then re-emits them to stderr in a structured format.

The implementation includes:
- BoundaryLog proto messages and ReportBoundaryLogs RPC (API v2.7)
- BoundaryLogProxy server that accepts connections from boundary processes
  on a Unix socket and forwards logs to coderd
- Server-side handler that formats logs to stderr
- Environment variables CODER_BOUNDARY_LOG_SOCKET and CODER_WORKSPACE_ID
  automatically set for all commands in the workspace

Architecture:
- Boundary process connects to Unix socket at $CODER_BOUNDARY_LOG_SOCKET
- Sends length-prefixed protobuf ReportBoundaryLogsRequest messages
- Agent proxies messages to coderd via DRPC
- coderd re-emits to stderr

Log format:
[API] 2025-12-08 20:58:46.093 [warn] boundary: workspace.id=... decision=deny http.method="GET" http.url="..." time="..."

…LogProxyServer

The socket path is now configured via the workspace template by setting
CODER_BOUNDARY_LOG_SOCKET. This allows both the agent and boundary to
use the same path without needing to pass it through child processes.

- Remove boundaryLogProxyMu (no longer needed)
- Only start proxy if CODER_BOUNDARY_LOG_SOCKET is set
- Only start forwarder if proxy was started
- Remove code that set env var for child processes

Read CODER_BOUNDARY_LOG_SOCKET from manifest.EnvironmentVariables instead
of os.Getenv. This allows the socket path to be configured via coder_env
in the workspace template.

The proxy is now started in handleManifest after the manifest is fetched,
rather than in init() before the manifest is available.

Add --boundary-log-socket flag (env: CODER_AGENT_BOUNDARY_LOG_SOCKET) to
configure the boundary audit log socket path. The agent starts the proxy
server in init() if configured.

This replaces reading the socket path from manifest.EnvironmentVariables,
making configuration consistent with other agent flags.

- Remove workspace_id from proto (coderd gets this from agent auth)
- Add nested HttpRequest message with method, url, matched_rule
- Use oneof resource to support future resource types (file ops, etc.)
- Update BoundaryLogsAPI to handle new structure with type switch
- Add comment noting wire compatibility with boundary's proto
- Remove unused codersdk/agentsdk/boundary_logs.go
- Regenerate proto Go code

Always create socket at /tmp/boundary-audit.sock instead of using
CLI flag or env var. This simplifies configuration since boundary
uses the same well-known path.