Add Google SecOps (Chronicle) output via the v1 events.import API

Sends parsed reports to a Google SecOps instance as pre-normalized UDM
events through the GA v1 Chronicle API:

    POST https://chronicle.{region}.rep.googleapis.com/v1/{parent}/events:import

Pre-normalized events bypass SecOps's server-side (CBN) parsing layer,
so no parser needs to be installed in the tenant; the CBN parser in
google_secops_parser/ remains the collector-based alternative for
deployments that want raw-log retention, and both paths emit the same
UDM shape and additional-field keys so searches port between them.
Google's ingestion docs recommend the UDM-events path when possible.

Implementation notes, all grounded in the v1 reference docs:

- Auth is standard Google Cloud IAM (Chronicle API Editor role /
  chronicle.events.import permission): a service account key file when
  [gsecops] credentials_file is set, Application Default Credentials
  otherwise. google-auth was already a transitive requirement via
  mailsuite[gmail]; it is now declared directly.
- Batches follow the documented best practices (1,000 events per
  request, 60 s timeout). events.import is all-or-nothing — one invalid
  event rejects the whole request — so a rejected batch is bisected to
  isolate invalid events; valid events are still delivered and the drop
  count is raised as an output error at the end.
- to and subject are repeated fields in the UDM Email message;
  SecurityResult action and category are repeated enums.
- additional is a protobuf Struct, so counts and ASNs stay numbers and
  alignment flags stay booleans — range-queryable without the CBN
  string-hop.

New [gsecops] config section (project_id, instance_id, region,
credentials_file) is wired through the INI schema, _parse_config,
Namespace defaults, PARSEDMARC_GSECOPS_* env vars, the usage docs, and
per-batch client construction (SIGHUP-reload safe by construction).

Tests build events from real sample reports and assert on the payloads
sent through a mocked AuthorizedSession, including batching and the
400-bisect path.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/source/usage.md

@@ -565,6 +565,27 @@ The full set of configuration options are:
   - `smtp_tls_url` - str: URL of the webhook which should receive the smtp_tls reports
   - `timeout` - int: Interval in which the webhook call should timeout
 
+- `gsecops` - Send reports to [Google SecOps](https://cloud.google.com/security/products/security-operations)
+  (Chronicle) as Unified Data Model (UDM) events via the v1 Chronicle API
+  [`events.import`](https://docs.cloud.google.com/chronicle/docs/reference/ingestion-methods)
+  method. Pre-normalized UDM events bypass SecOps's server-side parsing, so no
+  custom parser needs to be installed in the tenant (the alternative,
+  raw-log-preserving path is the syslog output plus the parser in the
+  [google_secops_parser](https://github.com/domainaware/parsedmarc/tree/master/google_secops_parser)
+  directory).
+  - `project_id` - str: The Google Cloud project ID linked to the SecOps
+      instance at onboarding. A correctly-permissioned account in any other
+      project will fail to authenticate.
+  - `instance_id` - str: The SecOps instance (customer) GUID, shown under
+      **SIEM Settings > Profile** in the SecOps console
+  - `region` - str: The SecOps instance region, e.g. `us` or `europe`
+      (Default: `us`)
+  - `credentials_file` - str: Path to a Google service account JSON key file.
+      When not set, [Application Default Credentials](https://cloud.google.com/docs/authentication/application-default-credentials)
+      are used. Either way, the account must hold the **Chronicle API Editor**
+      IAM role (the `chronicle.events.import` permission) in the linked
+      project.
+
 :::{warning}
 It is **strongly recommended** to **not** use the `nameservers`
 setting. By default, `parsedmarc` uses
@@ -766,6 +787,7 @@ For sections with underscores in the name, the full section name is used:
 | `log_analytics` | `PARSEDMARC_LOG_ANALYTICS_` |
 | `gelf` | `PARSEDMARC_GELF_` |
 | `webhook` | `PARSEDMARC_WEBHOOK_` |
+| `gsecops` | `PARSEDMARC_GSECOPS_` |
 
 ## Performance tuning