feat: capture, persist, and strip Agent Firewall correlation headers in AI Bridge (#26529)

Wire the Agent Firewall correlation headers
(`X-Coder-Agent-Firewall-Session-Id` and
`X-Coder-Agent-Firewall-Sequence-Number`) through the AI Bridge
interception processor so that each interception is linked to its
originating firewall session.

Closes https://linear.app/codercom/issue/AIGOV-259

> Generated by Coder Agents on behalf of @SasSwart

**Data flow:**
`request header` → `bridge.go` reads + strips → `InterceptionRecord` →
`translator.go` → proto `RecordInterceptionRequest` →
`aibridgedserver.go` → DB

coderd/aibridged/translator.go

@@ -25,20 +25,22 @@ type recorderTranslation struct {
 
 func (t *recorderTranslation) RecordInterception(ctx context.Context, req *aibridge.InterceptionRecord) error {
 	_, err := t.client.RecordInterception(ctx, &proto.RecordInterceptionRequest{
-		Id:                    req.ID,
-		ApiKeyId:              t.apiKeyID,
-		InitiatorId:           req.InitiatorID,
-		Provider:              req.Provider,
-		ProviderName:          req.ProviderName,
-		Model:                 req.Model,
-		UserAgent:             req.UserAgent,
-		Client:                req.Client,
-		ClientSessionId:       req.ClientSessionID,
-		Metadata:              marshalForProto(req.Metadata),
-		StartedAt:             timestamppb.New(req.StartedAt),
-		CorrelatingToolCallId: req.CorrelatingToolCallID,
-		CredentialKind:        req.CredentialKind,
-		CredentialHint:        req.CredentialHint,
+		Id:                          req.ID,
+		ApiKeyId:                    t.apiKeyID,
+		InitiatorId:                 req.InitiatorID,
+		Provider:                    req.Provider,
+		ProviderName:                req.ProviderName,
+		Model:                       req.Model,
+		UserAgent:                   req.UserAgent,
+		Client:                      req.Client,
+		ClientSessionId:             req.ClientSessionID,
+		Metadata:                    marshalForProto(req.Metadata),
+		StartedAt:                   timestamppb.New(req.StartedAt),
+		CorrelatingToolCallId:       req.CorrelatingToolCallID,
+		CredentialKind:              req.CredentialKind,
+		CredentialHint:              req.CredentialHint,
+		AgentFirewallSessionId:      req.AgentFirewallSessionID,
+		AgentFirewallSequenceNumber: req.AgentFirewallSequenceNumber,
 	})
 	return err
 }