example(alb): add observability and alerting example

[FloMicSch]

Description

Adds examples/alb-observability-and-alerting: an Application Load Balancer with an HTTPS listener, a self-signed certificate, an active health check and a minimal WAF configuration in front of two backend VMs in different availability zones, shipping its metrics and logs into a STACKIT Observability instance via options.observability.

No existing example uses options.observability or stackit_loadbalancer_observability_credential, and the WAF examples show how to block traffic but not how to see what was blocked. This example closes that day-2 gap:

• Observability wiring: stackit_observability_instance, stackit_observability_credential, stackit_loadbalancer_observability_credential, with the instance's logs_push_url and metrics_push_url on the load balancer
• A PromQL alert group (target pool degraded/unhealthy, health check failure rate, throughput spike/drop, missing metrics, rejected samples) and a LogQL alert group on the WAF log stream (block rate spike, custom rule match), with an optional email or webhook receiver behind variables
• A Grafana dashboard (dashboards/alb-overview.json), imported once through the Grafana UI
• A small backend application whose health, status code, delay and response size can be chosen per request, so every alert can be triggered on purpose

The load balancer exports a fixed metric set (health checks, connections, bytes) and STACKIT does not document the names, so every metric name, label and log field used by the rules and the dashboard was read from a live instance; the README documents the exported telemetry and the discovery commands.

Tested

Deployed end to end in a sandbox project (eu01, provider 0.113.0):

• Metrics and logs confirmed arriving in the Observability instance; every dashboard panel returns data (verified through the Grafana query API after an import)
• Alerts observed firing in Alertmanager, each triggered with the commands from the README's Testing section: AlbTargetPoolDegraded, AlbTargetPoolUnhealthy, AlbHealthCheckFailures, AlbTrafficSpike, AlbTrafficDrop, AlbMetricsAbsent, AlbWafBlockRateSpike, AlbWafCustomRuleTriggered
• terraform fmt -recursive and terraform validate clean, Apache license headers on all .tf files, README tags, TODO and file naming checks pass, AGENTS.md regenerated

Known limitations

• The load balancer emits no request-level telemetry (request counts, status codes, latencies) and no access logs, so error-ratio and latency alerts cannot be built today; request-level information is only available for requests inspected by the WAF. The README states this and points to the discovery commands for when enhanced log delivery ships.
• ObservabilitySamplesRejected could not be triggered on demand; it is built on the documented plan limit and the instance_remote_write_samples_rejected_total counter of the instance itself.

Checklist

• The CI pipeline passed successfully.