feat(kms): wire OperationContext into an audit event contract

`OperationContext` carried identity and correlation data that nothing
ever constructed or read, so key creation, rotation and deletion left no
trace of who requested them.

Give every management operation a `*_with_context` entry point that
builds a `KmsAuditRecord` and hands it to an installed `KmsAuditSink`.
The record answers who acted on which key, against which backend, with
what outcome and error class, and how long it took. Existing entry points
delegate with an explicitly internal principal, so an unattributed call
is distinguishable from an identity that was lost.

The backend trait is untouched: auditing sits at the layer that has an
identity, mirroring how metrics sit at the backend choke point. The sink
is optional and no records are built without one, so a deployment that
does not consume them is unaffected. Records also cover the background
sweep that destroys expired key material, which is otherwise the least
observable operation in the crate.

Redaction is structural rather than advisory: a record has no field that
can hold key material, and caller-supplied encryption context passes
through an allowlist that digests everything it does not recognise.
Tenant attribution is deliberately left out until tenancy is modelled.

Refs rustfs/backlog#1583 (part of rustfs/backlog#1562)

scripts/check_logging_guardrails.sh

@@ -27,6 +27,9 @@ checked_files=(
   "rustfs/src/storage/rpc/http_service.rs"
   "rustfs/src/storage/rpc/node_service.rs"
   "crates/kms/src/config.rs"
+  "crates/kms/src/audit.rs"
+  "crates/kms/src/manager.rs"
+  "crates/kms/src/deletion_worker.rs"
   "crates/audit/src/pipeline.rs"
   "crates/audit/src/system.rs"
   "crates/audit/src/global.rs"