pipelines: drop 7 broken-legacy transform_ocsf entries

[natesmalley]

Summary

Follow-up to #59, #60, and #61 (all merged). Drops 7 broken-legacy entries from pipelines/community/transform_ocsf/ that share the exact fingerprint already established by palo_alto_networks_firewall/ in #60: sub-passing grade, grader couldn't validate, no OCSF class produced, no matching upstream parser. Each has at least one working alternative covering the same vendor cluster.

Removed entries

Directory	Grade	Verdict	class_uid	Required-field coverage	Working alternative
aws_cloudtrail/	D/60	analyzer_limit	null	0%	bound-parser AWS entries
aws_guardduty/	F/45	analyzer_limit	null	0%	aws_guardduty_logs/ (B/85)
darktrace/	D/60	analyzer_limit	null	0%	darktrace_darktrace_logs/ (B/85)
gcp_audit_logs/	F/25	analyzer_limit	null	0%	bound-parser GCP entries
microsoft_365/	D/60	analyzer_limit	null	0%	microsoft_365_mgmt_api_logs/ (B/82)
okta/	F/45	analyzer_limit	null	0%	okta_logs/ (B/85), okta_ocsf_logs/ (B/85)
wiz_issue/	D/60	analyzer_limit	null	0%	wiz_cloud_security_logs/ (B/85)

Why these specifically

All seven entries share the same fingerprint as palo_alto_networks_firewall/ removed in #60:

• Sub-passing grade (D or F).
• verdict: analyzer_limit — the automated grader could not validate the serializer's OCSF output.
• class_uid: null — no valid OCSF class is produced.
• required_field_coverage_pct: 0.
• source_name lacks the -latest versioning suffix used by every working entry in the directory.
• No matching upstream parser in parsers/community/.
• Long-form Python-port style code (632–1720 lines), author: Community (imported from Observo platform UI), rather than the contributor-import style used by the rest of the directory.

What is NOT in this PR (intentional)

• Multi-entry vendor clusters with all-signed_off members are kept — Cisco/Fortinet/Cloudflare/Zscaler/Akamai/etc. each have multiple entries that bind to genuinely-distinct upstream parsers or cover different OCSF classes. They will be documented per-entry in the upcoming migration PR (PR Add pipelines section to README #5), following the pattern established for PAN-OS in pipelines: drop F-graded PAN-OS firewall transform; document PAN-OS variants #60.
• Doubled-name singletons (forcepoint_forcepoint_logs, incapsula_incapsula_logs, mimecast_mimecast_logs, singularityidentity_singularityidentity_logs, tailscale_tailscale_logs) are all signed_off with B/82–85 grade and 100% required-field coverage. They are just badly named — fix in the rename PR (PR Correction Fortigagte typo to Fortigate, dir and metadata #6).
• m365_audit_logs/ and crowdstrike_detections/ are intentionally retained. Both are signed_off with valid class_uid and ≥75% required-field coverage; while they overlap functionally with cleaner alternatives (microsoft_365_mgmt_api_logs/, crowdstrike_logs/), they are not broken and removal would be a regression for any user currently importing them.
• No serializer logic, no other metadata fields, and no pipeline JSONs in surviving entries are modified.

Test plan

• CI passes (CodeQL, secret scanning, contributor automation)
• git log --stat shows exactly 28 file deletions across 7 directories (metadata.yaml + <name>.json + sample.json + serializer.lua per directory)
• No content outside pipelines/community/transform_ocsf/{aws_cloudtrail,aws_guardduty,darktrace,gcp_audit_logs,microsoft_365,okta,wiz_issue}/ and CHANGELOG.md was modified
• No other repo content references the removed paths (search for the directory names across the tree)
• The working alternatives listed above remain unchanged and continue to render cleanly on github.com