core: use stable structured log event names and field keys - #25121

Details

What does this PR change?

Fixes the structured logging anti-pattern where runtime values were used as log event names or spread as structured field keys. Runtime data is now emitted as isolated field values under fixed, predictable keys.

Specific changes made across the codebase:

• authentik/sources/kerberos/sync.py, authentik/sources/ldap/sync/users.py, authentik/sources/ldap/sync/groups.py: property-mapping-built defaults dicts were spread as field keys (**defaults), meaning caller-controlled attribute names became log field keys. They are now safely nested under a single stable attributes key.
• authentik/blueprints/v1/importer.py: f"Entry invalid: {exc}" and f"Entry invalid on retry: {exc}" were replaced with the stable event names "Entry invalid" and "Entry invalid on retry". The exception details are now attached to the error field.
• authentik/providers/saml/processors/authn_request_parser.py: The ACS URL mismatch warning used interpolated URLs as the root event name. It now logs a stable event ("saml_acs_url_mismatch") while capturing the endpoints securely via request_acs_url and provider_acs_url fields. The CannotHandleAssertion exception message thrown to the browser remains unchanged.
• authentik/tasks/models.py: Exception text is no longer used as the event name in the Task.info/warning/error entrypoints. Bare exceptions now produce the stable events "Task has encountered an error" / "Task has encountered an error and will be retried". Full exception details remain preserved in the exception attribute via exception_to_dict.
• authentik/tasks/schedules/scheduler.py: f"Sent {count} scheduled tasks" was changed to "Sent scheduled tasks" with a distinct count field.
• authentik/outposts/controllers/docker.py: f"SSH Managed externally: {exc}" was changed to the stable event "SSH Managed externally" with an error field.

(Note: events/logs.py (LogEvent.log()) was intentionally left unchanged as it simply replays previously captured log events from the task log fallback. With the _make_log fix above, the events flowing through it will inherently have stable names at their source).

Why is this change needed?

Dynamic event names and arbitrary field keys cause unbounded cardinality growth in log indexes and facets (e.g., Datadog, Elasticsearch). They split one logical event across thousands of names and make structured queries, dashboards, and alerting incredibly difficult to maintain. By migrating to a static event taxonomy, the semantic information is preserved while ensuring predictable, queryable log structures.

How was this tested?

1. Linters: ruff check, ruff format --check, and bandit passed successfully on the changed files via make lint and make lint-fix.
2. Backend Emulation (SAML):
   • Ran make run to launch the backend server.
   • Executed tests/trigger_bug_reproducer.py to spoof a SAMLRequest XML payload with a maliciously mismatched ACS URL against the SSO binding redirect endpoint.
   • Logs Result: Verified in the terminal (make run 2>&1 | grep -i warning) that the backend cleanly emits the structured JSON log saml_acs_url_mismatch instead of the dynamic sentence.
3. Frontend Verification: Verified that the frontend gracefully handles the intercepted CannotHandleAssertion(msg) exception and correctly displays the "Bad Request" page with the full descriptive string unchanged (ACS URL of https://hacker.com...).

Linked issues

closes #22196

Checklist

• The project has been linted, built, and tested (make all)
• The documentation has been updated and formatted (make docs)