fix: port upstream ClickHouse parser and detection fixes (B3 of #369)

[mayankpande88]

Summary

Third batch of #369: the ClickHouse parser and detection fixes from upstream coroot-node-agent, all cherry-picked with -x.

Upstream	Change
coroot/coroot-node-agent@a8a084f (Nikolay Sivko)	A new ClickHouse query parser replaces the one built on ch-go. Queries that carry settings were lost: their span had an empty db.statement, and the empty parse counted as a parse failure. Garbage length prefixes can't turn into large allocations. The ch-go dependency is gone.
coroot/coroot-node-agent@a64920a / b53b38d (Nikolay Sivko)	Stricter eBPF ClickHouse detection: the query header (query ids, user, address, interface) and the response structure are validated, so other traffic on ports 9000/8123 isn't taken for ClickHouse.
coroot/coroot-node-agent@556154b (Nikolay Sivko)	An offset bound in that parser, which the verifier needs on older kernels.

Plus one fix of our own, from review (08d1e10): the ClickHouse detection functions no longer read past the payload. The query check could not return a wrong answer, but the response check decided short reads from bytes that were not part of the payload. Every read is now checked against the payload size first. This diverges from upstream.

ebpf.go is regenerated.

Not taken from B3:

• 2d8fb1b (RabbitMQ/ClickHouse misclassification), eBPF half: this fork already classifies any AMQP frame on 5672 as RabbitMQ before ClickHouse detection, which only runs on 9000/8123. Its test case is included with a8a084f.
• 6d5addb (drop L7 events with unknown protocols): L7Stats here creates no metric vector for an unknown protocol, and observe skips nil vectors.

Engineering detail

Conflicts:

• a8a084f: this fork had already hardened the old ch-go parser: a LimitReader, header checks and a recover. Upstream's parser replaces all of it.
• b53b38d: the fork had added an AMQP basic.publish check to is_clickhouse_query. The stricter header validation rejects AMQP frames anyway.
• Call site: is_clickhouse_response now takes the read size, so its call in trace_exit_read passes ret.

Bounds checks (08d1e10): the e2e below was re-run with them in: same counts, same statement texts. All 40 programs load on 5.10 and 6.1.

CI: gofmt, goimports, vet, golangci-lint, go test (excluding /containers, including the new ClickHouse parser cases) and the build all pass in a Linux container with Go 1.26.5.

Local e2e: I built agent binaries from this branch and from main and ran both side by side on a local Debian 12 VM (kernel 6.1), each sending spans to its own OpenTelemetry collector. A clickhouse-go v2.46 client ran 20 rounds against a local ClickHouse 25.8 on port 9000. Each round sent a plain SELECT, a SELECT with settings (max_execution_time, max_threads) and a query with a syntax error.

• Query counts: both builds counted 40 ok and 20 failed queries.
• Spans: this branch's spans carried the text of all three statements. Main's spans for the query with settings had an empty db.statement all 20 times.
• Program load: both loaded all 40 eBPF programs on 6.1 without errors. This branch also loaded all 40 on a 5.10 kernel.

[gemini-code-assist]

Code Review

This pull request refactors the ClickHouse protocol parser by replacing the external ch-go dependency with a custom, allocation-free Go parser to prevent OOMs on corrupted payloads, and updates the corresponding eBPF tracer logic in C. The review feedback highlights critical safety issues in the eBPF code, specifically potential out-of-bounds reads in both is_clickhouse_query and is_clickhouse_response due to missing bounds checks against buf_size before bpf_read operations. Additionally, in the Go parser, it was recommended to remove an unnecessary unconditional slice truncation that could corrupt valid trailing characters, as the subsequent UTF-8 validation loop already handles partial runes.