geoip enrichment pipeline for rum data

[kualta]

Summary

• iron's `observability::sync` now upserts a `geoip_enrich` VRL function and a `rum_geoip` realtime pipeline. The pipeline runs at `_rumdata` ingest: `get_enrichment_table_record("maxmind_city", {"ip": .ip})` -> writes `country_code` and `country_name` columns onto every event.
• OpenObserve auto-downloads the MaxMind GeoLite2-City.mmdb on boot (`ZO_MMDB_GEOLITE_CITYDB_URL` from zinclabs's mirror, monthly refresh) - no API key, no manual setup.
• Switched the "Visitors by country" chart in fleet.charts.toml off locale-based extraction and onto the enriched `country_code` field. Filter `WHERE country_code IS NOT NULL` drops anycast IPs that have no country in the database.

Test plan

• cargo fmt, clippy -D warnings, test (11 unit tests still green)
• iron deploy observe -> function + pipeline both upserted, idempotent on second run
• Ingested test events with IPs 8.8.8.8 (US), 5.62.55.1 (IE), 1.1.1.1 (anycast - null country) - country_code on the first two, null on the third as expected
• After real RUM traffic lands post-deploy, the world map shows highlights based on visitor IPs instead of locale headers