Vouch request: galleonli

[galleonli]

What do you want to work on?

I'd like to work on #2640, which adds optional trace_id and span_id fields to OCSF security events.

My plan is to start with the event builders and the supervisor call sites, and only include these fields when trace context is available. I'd also add tests for both cases and make sure the implementation lines up with the supervisor tracing changes in #3977.

Why this change?

This would make debugging denied network requests a lot easier. If the audit event contains the trace ID, you can jump directly to the related trace instead of trying to match sandbox IDs and timestamps between the audit logs and tracing system.

Checklist

• I wrote this request myself (not AI-generated)
• I have read CONTRIBUTING.md