fix(flags): relax StatsigEventSerializer validation for unused fields

[sentry]

Summary

Fixes SENTRY-5J6Z

Overly strict validation in StatsigEventSerializer for unused fields causes DeserializationError when processing Statsig webhooks containing unexpected formats.

Root Cause

StatsigEventSerializer defined strict type constraints on several fields that Sentry doesn't actually use in the handle() method:

• user was DictField(child=serializers.CharField()) — rejected nested dictionaries (e.g. {"custom": {"nested": "object"}})
• value was CharField(required=False) — rejected empty strings (blank not allowed by default)
• timeUUID was UUIDField(required=False) — rejected non-UUID format strings
• statsigMetadata and unitID — also unused but defined

When Statsig sent webhooks containing any of these unexpected formats, the serializer rejected the entire payload and raised a DeserializationError, preventing valid audit log events from being processed.

Fix

• Remove unused fields (value, statsigMetadata, timeUUID, unitID) from the serializer entirely. DRF silently ignores undefined fields, so any format Statsig sends for these will be accepted without validation.
• Relax user validation by removing child=serializers.CharField() from the DictField, allowing nested objects that get_path() already handles correctly in the handler.
• Add allow_blank=True to userID for robustness.

The three required fields (eventName, timestamp, metadata) that are actually used by the handler remain strictly validated.