perf(forwarder): create scrubber, matcher, and batcher once in __init__

[LorisFriedel]

Summary

• _forward_logs() created a new DatadogScrubber (compiles regex per scrubbing rule), DatadogMatcher (compiles include/exclude regex), and DatadogBatcher on every call
• These are config-driven and stateless after construction
• Move all three to Forwarder.__init__() as self._scrubber, self._matcher, and self._batcher
• Since Forwarder is a container-global singleton, this also eliminates re-compilation across warm Lambda invocations
• Also simplifies the log evaluation loop in _forward_logs and uses idiomatic emptiness checks

Test plan

• Existing test_forwarder.py tests pass
• Verify log forwarding with include/exclude rules works end-to-end via integration tests

🤖 Generated with Claude Code

[ViBiOh]

💬 suggestion: ‏ We'll dump event to JSON even if we don't forward them with this change. Some event, especially cloudtrail, can be very large and that's why we wanted to dump only if required.

[LorisFriedel]

👍 I've updated the code to defer json.dumps until after matching. For dicts with a message field (CloudTrail), it now matches on the message string directly and only serialize if the event passes the filter. This avoids wasted serialization for excluded events!

[ViBiOh]

Great catch on the serialization concern! That said, this is actually what the code did before your change — you've essentially circled back to the previous behavior, just with the matching logic split across three branches now. The original version intentionally serialized once and matched once in a single path, which I'd argue was easier to follow. 🤖