enhancement(sources): add subject_altnames to TLS client metadata

[emillen]

Summary

tls_client_metadata (emitted by TLS sources when client_metadata_key is set)
currently exposes only the client certificate subject. This PR adds
subject_altnames with the certificate's Subject Alternative Names — the real
entity identity in modern/mTLS PKI — so operators can distinguish, enrich,
route, and audit clients by their SANs.

• Comma-separated, type-prefixed to match openssl x509 -text
  (e.g. DNS:localhost,IP Address:127.0.0.1).
• Only present when the cert contains SANs; additive, no config change.
• Covers all sources supporting client_metadata_key (fluent, logstash, socket,
  statsd, syslog, TCP-mode dnstap) via the shared build_tls_client_metadata.
• Also fixes logs_output.html so the nested subject/subject_altnames
  options render on the reference docs.

References

Closes: #26111
Related: #11905 (original tls_client_metadata feature)

Vector configuration

Receiver (syslog with mTLS):

sources:
  syslog:
    type: syslog
    mode: tcp
    address: "0.0.0.0:9000"
    tls:
      enabled: true
      verify_certificate: true
      ca_file: "./tls/ca.cert.pem"
      crt_file: "./tls/server.cert.pem"
      key_file: "./tls/server.key.pem"
      client_metadata_key: tls_peer

transforms:
  tls_metadata:
    type: remap
    inputs: [syslog]
    source: |
      .tls_subject = .tls_peer.subject
      .tls_subject_altnames = .tls_peer.subject_altnames
      del(.tls_peer)

sinks:
  console:
    type: console
    inputs: [tls_metadata]
    encoding:
      codec: json

Sender: demo_logs → socket sink over TLS with a client cert that has SANs.

How did you test this PR?

• Manual end-to-end test of the config above (throwaway CA/server/client PKI);
  receiver output included "tls_subject_altnames":"DNS:localhost,IP Address:127.0.0.1".
• Unit tests for CertificateMetadata::subject_altnames (vector-core) and
  build_tls_client_metadata (key present with SANs, absent without).
• make fmt, make check-fmt, make check-markdown, make check-generated-docs
  pass; scoped clippy on vector/vector-core clean.
  (Full make check-clippy is blocked by a pre-existing krb5-src C-dependency
  build failure under newer GCC via kafka's gssapi-vendored feature.)

Is this a breaking change?

• Yes
• No

Does this PR include user facing changes?

• Yes. Changelog fragment added.
• No. A maintainer will apply the no-changelog label to this PR.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[emillen]

I have read the CLA Document and I hereby sign the CLA

[pront]

Thanks @emillen