fix: scrub nested privacy structures recursively

[abrichr]

Summary

• recurse through dictionaries and lists at every GUI structure depth
• preserve the state scrub-all rule across direct values and nested containers
• retain non-string geometry and metadata while scrubbing configured text fields

Root cause

The dictionary scrubber handled nested dictionaries, but it applied list rules only to direct string items. GUI trees can contain dictionaries and lists inside other lists. Text in those nested containers could remain unchanged even when the parent structure required scrubbing.

Impact

Structured GUI observations now apply one scrub state through the complete nested tree. This closes the path where patient or account text inside child elements, nested lists, or state containers could remain in an otherwise scrubbed derivative.

Validation

• uv run --extra dev pytest tests/ -v --ignore=tests/test_presidio.py (71 passed, 1 skipped)
• uv run --extra dev ruff check openadapt_privacy/base.py tests/test_pipelines.py
• uv build
• python scripts/check_source_boundary.py --require-dist
• git diff --check origin/main...HEAD

The built wheel and source archive pass source policy sha256:09e5092a6f84cbad0b588a9aec65cc7d26492dced2ddce26ca288a3ff81992c9.