ingestor: warn when observerIATAWhitelist drops a region without unbounded throttle state #110

Upstream source

Evaluate and port Kpa-clawbot/CoreScope#2067: emit a throttled warning when observerIATAWhitelist rejects an incoming region.

Why this is still relevant here

Current fork master silently returns when Config.IsObserverIATAAllowed(parts[1]) is false. A legitimate region omitted from the allow-list can therefore lose all traffic without an operator-facing explanation.

The upstream implementation also fixes an important abuse case: the rejected IATA/topic segment is publisher-controlled, so an unbounded per-code throttle map would be a remote memory sink.

Acceptance criteria

• A rejected region produces a fixed, grep-friendly warning containing the normalized region code.
• Repeated traffic for the same code is throttled using a configurable interval with a safe default.
• The per-code throttle state is strictly bounded.
• Traffic beyond the bound is not silently ignored; use a bounded/shared overflow warning path.
• Expired entries are reclaimed so the first observed codes do not own the map forever.
• Allowed traffic and an empty whitelist behave exactly as today.
• Tests cover normal throttling, interval expiry, more distinct attacker-controlled values than the cap, overflow behaviour and expired-slot reclamation.
• Run the ingestor suite with -race.
• Document the optional configuration key in this fork's configuration reference/example if one exists.

No production configuration change or deploy is part of this issue.