[ENGMP-365] Add protection triggered counter metric and log action logging

[yishi3-db]

What did you change, and why?

• Extracted rule action handling into applyProtectionResult() to make it extensible for future actions
• Added log action: logs a message when a protection rule triggers
• Added thanos_query_frontend_protection_triggered_total counter metric with labels action (block/log) and rule (rule name)
• Changed block action response code from 400 to 403 to better reflect "query explicitly forbidden" semantics

How do you know it works?

Verified in dev-aws-us-east-1-obs-integrationtest:

• block action returns 403 and increments the counter
• log action logs the message and increments the counter