Adds the new metadata fields introduced by #59 to all 129 existing
transform_ocsf/ pipeline metadata.yaml files. The fields are inserted
immediately after the existing ingestion_method line in each file. No
serializer logic, no pipeline JSON, no other metadata changed.

Values were derived per entry by combining:

1. Bound parser metadata (parsers/community/<source_name>/metadata.yaml)
   when the parser declares format=syslog/CEF/RFC/w3c/custom-syslog or
   ingestion_method containing "Syslog" or "HEC" -- the parser is
   authoritative when its declaration is unambiguous.

2. Vendor and product knowledge for the ~90 entries where the parser
   metadata is unclear (gron format with "streaming" or "unknown"
   ingestion_method, or no parser binding at all). Examples:
   - Cisco network kit (firewalls, ASA, Meraki, ISE, etc.) -> Syslog
   - Microsoft 365 / Entra / Defender management surfaces -> API Call (OAuth)
   - AWS managed services delivering to S3 (CloudTrail, ELB, Route53
     Resolver, GuardDuty export, VPC flow) -> Other - {object store with
     SQS notifications} (IAM Role)
   - Azure Event Hub-delivered streams (signin, defender email) ->
     Other - {Azure Event Hub stream (AMQP/Kafka protocol)} (OAuth)
   - SaaS REST APIs (Okta, Snyk, Wiz, Tenable, Mimecast, Netskope,
     Proofpoint, GitHub, Google Workspace, Cloudflare, etc.) -> API Call
     with the vendor's typical auth (Bearer Token, API Key & Secret,
     or OAuth)

Confidence per entry is recorded in
.reorg-prep/inventory/transform_ocsf_classifications.tsv as one of
high (103), medium (17), or low (9). Low-confidence entries are
genuinely generic placeholders (json_generic_logs, sample_test_logs,
microservice_tracing_logs, etc.) where a more specific value is not
derivable; they use Other - {Explain: ...} with the reason inline.

palo_alto_networks_firewall/ is intentionally not modified because it is
being removed in PR #60 (open).

Resulting distribution:
  Syslog                                              56
  API Call                                            39
  Other - {object store / Event Hub / agent / etc.}   34

Auth distribution:
  N/A (syslog / file-based / generic)                 75
  API Key & Secret                                    20
  OAuth                                               18
  IAM Role                                             8
  Bearer Token                                         7
  Other (Kafka SASL)                                   1

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Moves 91 community pipeline directories from
pipelines/community/transform_ocsf/<name>/ into the ingest-mode-first
taxonomy introduced in #59:

  pipelines/push/syslog/<vendor>/<product>/      57 entries
  pipelines/pull/api/<vendor>/<product>/         29 entries
  pipelines/pull/object_store/<vendor>/<product>/  5 entries

The mode bucket is determined by each entry's ingest_mode field (backfilled
in #61). The vendor and product split is derived per entry from the
upstream parser binding and vendor/product convention; collisions across
the cluster (Cisco Meraki, Fortinet, Cloudflare, Zscaler, Microsoft, etc.)
are disambiguated with explicit product-name overrides documented in
.reorg-prep/inventory/transform_ocsf_migration_plan.tsv.

History is preserved on every entry (git mv).

What stays in pipelines/community/transform_ocsf/ (15 entries):
  - Generic / template / unknown-vendor entries: agent_metrics_logs,
    generic_access_logs, inngate_gateway_logs, json_generic_logs,
    json_nested_kv_logs, leef_template_logs, log4shell_detection_logs,
    mail_server_logs, microservice_tracing_logs, sample_test_logs,
    spam_detection_logs, sql_database_logs, syslog_space_delimited_logs,
    vpc_logs, jruby_application_logs.

What is NOT in this PR (intentional):
  - 23 entries scheduled for removal in #62 (broken-legacy, 7) and #63
    (first-party ingestion paths, 16) are NOT moved; they remain in
    transform_ocsf/ until those PRs merge. This PR has no overlap or
    conflict with #62/#63 -- merge order does not matter.
  - No serializer logic, no metadata.yaml content, and no pipeline JSON
    content was modified. Every change is a directory rename.
  - No naming-consistency cleanup (e.g., paloalto_* -> palo_alto/*) is
    applied yet; that is a separate follow-up.

The pipelines/push/{syslog,hec}/ and pipelines/pull/{api,object_store}/
directories are now populated -- the empty scaffolding from #59 finally
has content.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>