pipelines: drop 16 transform_ocsf entries with first-party ingestion paths

[natesmalley]

Summary

Scope refinement for pipelines/community/transform_ocsf/. Removes 16 directories whose vendors are typically ingested into AI SIEM via first-party or vendor-native paths in supported deployments rather than via community-contributed Observo transforms. The community pipelines directory is intended for vendors that require contributor-authored parsing and OCSF mapping.

Removed entries

• aws_guardduty_logs/
• aws_waf/
• azure_ad/ (legacy name for Microsoft Entra ID; removed alongside microsoft_entra_logs/ to avoid leaving the same product under two paths)
• azure_platform/
• cisco_duo/
• darktrace_darktrace_logs/
• microsoft_defender_for_cloud/
• microsoft_entra_logs/
• microsoft_eventhub_azure_signin_logs/
• microsoft_eventhub_defender_email_logs/
• microsoft_eventhub_defender_emailforcloud_logs/
• netskope/
• proofpoint/
• snyk/
• tenable_vulnerability_management_audit_logging/
• wiz_cloud_security_logs/

Why these specifically

Each removed entry was previously signed_off and functional — this is a scope refinement, not a quality fix. The criterion is "is there a typical first-party / vendor-native ingestion path users rely on for this vendor's data?" rather than any defect in the transforms themselves.

This is distinct from the prior cleanup PRs (#60 and #62) which removed entries that were broken (F-grade, analyzer_limit, no OCSF class produced). Those entries were dropped on quality grounds; the entries in this PR are dropped on scope grounds.

What is NOT in this PR (intentional)

• No serializer logic changed in any surviving entry.
• No surviving entry's metadata, sample, or pipeline JSON changed.
• No directory renames or migrations — that work is the next PR (migration of remaining transform_ocsf/ entries into the push/pull/<mode>/<vendor>/<product>/ taxonomy).
• m365_audit_logs/ and microsoft_365_mgmt_api_logs/ are retained — they cover Microsoft 365 audit/management API surfaces that are not first-party ingestion paths in supported deployments.
• azure_logs/, azure_nsg_flow_logs/, iis_w3c/, microsoft_activedirectory_logs/, windows_event_log_logs/ are retained — these are general Azure Monitor, NSG flow exports to storage, on-prem IIS, on-prem Active Directory, and Windows Event Log ingestion paths that customers configure manually.

Recovery

Each removed entry remains accessible via git log --diff-filter=D --name-only and can be restored from git history if a deployment specifically requires the community transform.

Test plan

• CI passes (CodeQL, secret scanning, contributor automation)
• git log --stat shows exactly 64 file deletions across 16 directories (metadata.yaml + <name>.json + sample.json + serializer.lua per directory)
• No content outside the 16 listed directories and CHANGELOG.md is modified
• No other repo content references the removed paths
• Surviving transform_ocsf/ entries continue to render cleanly on github.com