Stop applying user-scoped safety labels to unlisted viewers

[Pitchfork-and-Torch]

Bug

Tweet safety labels carry applicable_users on the proto (perspectival / holdback lists). SafetyLabelMap::from_proto_label_types keeps only the type key. Drop rules call has_safety_label, which is type presence only.

A DNA or civic label meant for viewer 42 therefore Drops viewer 999 on TimelineHomeRecommendations. The client proto_to_safety_label path already keeps applicable_users. The live filter map did not.

This is not country scope (PR 110) and not expiry (PR 106). Empty applicable_users stays everyone.

Fix

Keep per-type user lists on SafetyLabelMap. TweetPredicates::has_safety_label uses applies(label, viewer_id). Empty or missing scope is everyone. A scoped label does not apply when the viewer is missing or unlisted.

Proof

• Entry: SafetyLabel proto applicable_users
• Sink: DoNotAmplifyOonDropRule / other tweet-label Drops via has_safety_label
• Break: from_proto_label_types discarded user scope
• Viewer effect: holdback/control viewer dropped by a label that listed someone else
• Twin: visibility-filtering-client proto_to_safety_label keeps applicable_users; PR 110 is the country twin

Tests

• empty_users_applies_to_every_viewer
• scoped_label_applies_only_to_listed_viewer (fails on unmodified main)
• user_scoped_do_not_amplify_allows_unlisted_viewer_oon
• user_scoped_do_not_amplify_drops_listed_viewer_oon
• unit tests added; cargo test cannot run in the public dump