Allow passing in custom tags to telemetry

[derekmisler]

Closes: https://github.com/docker/gordon/issues/121

Add support for a TELEMETRY_TAGS environment variable that allows callers to attach custom key-value metadata to every telemetry event. This enables tracking where and how the binary is invoked (e.g., GitHub Actions, specific repos, workflows) without hardcoding provider-specific logic into the binary itself.

Changes

• pkg/telemetry/http.go: Parse TELEMETRY_TAGS env var (comma-separated key=value pairs) in createEvent() and merge them into event properties. System metadata (user_uuid, version, os, os_language) is written after tags to prevent spoofing. Empty keys and malformed entries (missing =) are silently ignored. Whitespace around keys and values is trimmed.
• pkg/telemetry/telemetry_test.go: Add two test suites:
  • TestCreateEventTelemetryTags — unit tests calling createEvent() directly, covering: single/multiple tags, whitespace trimming, malformed input, empty values, values containing =, system metadata protection, and operator-priority behavior.
  • TestTelemetryTags — integration tests using MockHTTPClient to verify tags appear in the actual HTTP request payload, including security and edge-case scenarios.

Test plan

• go test ./pkg/telemetry/ -run TestCreateEventTelemetryTags -v — 9 subtests
• go test ./pkg/telemetry/ -run TestTelemetryTags -v — 5 subtests
• go test ./pkg/telemetry/ — full suite passes with no regressions

[docker-agent]

Code Review Summary

✅ No issues found in the changed code.

The implementation correctly:

• Parses comma-separated key=value pairs from TELEMETRY_TAGS environment variable
• Uses strings.Cut() to split on the first = (correctly allowing = characters in values)
• Validates that keys are non-empty after trimming whitespace
• Trims both keys and values of leading/trailing whitespace
• Handles edge cases: empty values, malformed pairs without =, pairs with extra spaces
• Protects system metadata (user_uuid, version, os, os_language) by writing them AFTER tags, preventing spoofing

The test coverage is comprehensive and covers all the important edge cases including security concerns, whitespace handling, malformed input, and the critical system metadata protection test.

Great work on this feature!