feat: initial support for ASM inside the tracer

[florentinl]

Adds Application Security Management (ASM) – Threat Detection support to the Python Lambda layer.

What does this PR do?

• Ship libddwaf.so in the layer

  • Shared library that powers the core security‑rules engine
  • Size: 2.6 MB (adds ≈ 0.8 MB to the compressed layer)
  • Note: This requires to bump the layer size limit in the CI

• Parse incoming HTTP events and forward enriched data to ASM when enabled

  • Activation flag: DD_APPSEC_ENABLED
  • Note: This is deliberately distinct from DD_SERVERLESS_APPSEC_ENABLED (extension‑level enablement) currently in use by ASM clients in lambda

Motivation

Enable AppSec through the tracer in the context of AWS Lambda

Testing Guidelines

• unit tests for event information extraction
• benchmarking (using this repo) with DD_APPSEC_ENABLED=false to ensure that there is no impact with ASM disabled. before is main and after is this branch both using dd-trace-py from main :

• manual testing for now for ASM, integration tests will be done later in system-tests

Additional Notes

With appsec enabled during the benchmarks, I started to see the following logs:

failed to send traces to intake at http://localhost:8126/v0.4/traces: HTTP error status 400, reason Bad Request, message b'msgp: attempted to decode type "float64" with method for "int" at 0/0/Start\n'

The problem comes from a misplaced int cast when setting the start_ns of the lambda-url inferred span.

Types of Changes

• Bug fix
• New feature
• Breaking change
• Misc (docs, refactoring, dependency upgrade, etc.)

Check all that apply

• This PR's description is comprehensive
• This PR contains breaking changes that are documented in the description
• This PR introduces new APIs or parameters that are documented and unlikely to change in the foreseeable future
• This PR impacts documentation, and it has been updated (or a ticket has been logged)
• This PR's changes are covered by the automated tests
• This PR collects user input/sensitive content into Datadog
• This PR passes the integration tests (ask a Datadog member to run the tests)

[joeyzhao2018]

the self.response might not be a Dictionary, right?

[florentinl]

Yes you are right, it happens in two cases:

• malformed responses
• For API Gateway HTTP API events with payload version 2 or lambda function url events, the function may return just the body of the response

I pushed a fix, thank you.

[joeyzhao2018]

LTGM