feat: identify the device with an origin SD-ELEMENT

[DavidCozens]

Name the device in the record with SolidSyslogOriginSd — the software, its version, and the
enterprise number.

#define SYSLOG_SOFTWARE   "solid-syslog-example"
#define SYSLOG_SW_VERSION "0.1.0"

struct SolidSyslogOriginSdConfig originConfig = {
    .Software     = SYSLOG_SOFTWARE,
    .SwVersion    = SYSLOG_SW_VERSION,
    .EnterpriseId = SYSLOG_ENTERPRISE_ID,
};
sd[2] = SolidSyslogOriginSd_Create(&originConfig);

... [origin software="solid-syslog-example" swVersion="0.1.0" enterpriseId="32473"] device started

This lands after the store rather than before it. While records went straight out, the answer to
"who sent this" was implied by the connection they arrived on. Once records can replay hours later
that is no longer so, and the record has to carry it.

The ip PARAM is left out here. The address the collector sees is still the address that reached
it; the next stage takes that assumption away.

SYSLOG_ENTERPRISE_ID is defined in its own header rather than beside the element that carries it,
because the number identifies the vendor rather than the logger — anything else this product puts
its own name on wants the same one.

Enterprise number 32473 is reserved for documentation and testing by RFC 5612. A shipping product
uses its own, registered with IANA.

When you need it. If records will be correlated across devices, replayed after a delay, or
relayed through anything.

[DavidCozens]

@coderabbitai pause

[coderabbitai]

Note

Reviews paused

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

✅ Action performed

Reviews paused.