expand_trusted_server_bidders leaks the zone key into every bidder's PBS params

[prk-Jr]

Context

Surfaced in review of PR #910. Pre-existing, out of scope for that PR (which
drops empty/non-object bidder params), but it is a third route by which
TS-internal / fabricated params reach PBS, so it limits the "fabricated params
never ship" contract.

Problem

When a trustedServer slot entry has no bidderParams,
expand_trusted_server_bidders (crates/trusted-server-core/src/integrations/prebid.rs,
~L942-957) falls back to handing each configured bidder the entire
trustedServer params object as its params:

.unwrap_or_else(|| {
    if per_bidder.is_some() {
        Json::Object(Default::default())
    } else {
        params.clone() // <- entire trustedServer object, incl. `zone`
    }
})

So a zone-only slot (the JS adapter sends mediaTypes.banner.name as zone,
e.g. "header" / "fixed_bottom") ships:

"bidder": { "kargo": { "zone": "header" }, "triplelift": { "zone": "header" } }

zone is a TS-internal orchestration key — it is consumed server-side by the
bid-param override engine and should not be sent to PBS as a bidder param. These
values are non-empty, so the empty/non-object drop added in PR #910 never
catches them.

Suggested direction

• Strip TS-internal keys (zone, and any other orchestration-only keys) before
  the shared-params fallback hands the object to a bidder, or
• Only use the shared-params fallback for keys that are valid bidder params, or
• Require bidderParams and treat a bare trustedServer object as
  zone-context-only (no per-bidder expansion), letting override rules populate
  real params.

References

• PR Suppress fabricated empty Prebid bidder params #910 (fix/prebid-suppress-empty-bidder-params)
• crates/trusted-server-core/src/integrations/prebid.rs — expand_trusted_server_bidders, ZONE_KEY, bid_param_override_engine