Add an open challenge to break LogShield

[TurlaFSB]

States what counts as a bypass, how to test an idea in five minutes with logshield check, how to confirm it against real Log4j in the lab, and what a reporter receives.

What and why

Checklist

• make check passes (vet, lint, race tests, coverage floor)
• New behavior has table-driven tests; a bypass fix adds a regression entry to the corpus
• Any new payload is inert (reserved names only: example.com, *.invalid, 192.0.2.0/24)
• The engine stays pure (no I/O, clock, randomness, or global state) and bounded
• Docs and CHANGELOG updated where behavior changed
• No secrets, tokens, or real hostnames in code, tests, or fixtures