feat(ai): wire external HTTP guardrail providers on the input path

[rickcrawford]

What

Wires external HTTP guardrail providers into the AI gateway. An origin's guardrails.external list runs external guardrail services alongside the built-in checks; input-mode entries inspect the request before dispatch and block on a not-allowed verdict.

The generic adapter and LiteLLM mode mapping already existed but were never called by the runtime. This connects them and adds provider presets.

How

• GuardrailsConfig.external: Vec<ExternalGuardrailConfig> (new, #[serde(default)], no schema change since the type is deserialize-only).
• Provider presets (GuardrailProvider): Presidio posts {text, language} and treats a non-empty findings array as a flag; Generic/Lakera/Aporia post {input} and parse a common allowed/flagged/blocked verdict. Optional api_key on a configurable auth_header / auth_prefix (defaults to Authorization: Bearer).
• A pure verdict_blocks() decides blocking (mode blocks AND content disallowed; logging_only never blocks); run_input_external_guardrails() evaluates the default_on input-mode entries and returns the first block.
• Dispatch: a thin async step before the built-in pipeline extracts the request's input text (chat message text or per-surface input), runs the external input guardrails, and returns a 400 guardrail_violation on a block, matching the existing built-in guardrail block shape. Errors honor each entry's fail_open.

Scope / follow-ups

• Input path only this PR. Output-side (post_call) external guardrails and AWS Bedrock (SigV4 ApplyGuardrail) are not yet wired and are noted as follow-ups.
• default_on: true runs a guardrail on every request; per-request opt-in via metadata is not included.

Tests

• Pure unit tests in sbproxy-ai: Presidio vs generic request/response shapes, verdict_blocks across modes, config parsing with provider + auth defaults (8 external-guardrail tests pass).
• Full sbproxy-ai (962) and sbproxy-core (459) lib suites pass; clippy -D warnings and rustdoc -D warnings -D missing_docs clean; regenerated config schema is byte-identical (no schema change).