Add tests for guard.parseResourceResponse and guard.parseCollectionLabeledData

These two functions in internal/guard/wasm.go were completely untested
despite having high cyclomatic complexity:

- parseResourceResponse: 8 branches across resource map validation,
  description/secrecy/integrity tag parsing, and operation type switching
- parseCollectionLabeledData: 11+ branches with nested type assertions,
  array iteration, and per-item label parsing

New test file covers:
- Happy paths: full labels, partial labels, empty labels
- All four operation types (read, write, read-write, default)
- Non-string tags silently skipped in secrecy/integrity arrays
- Non-map item entries silently skipped in collection
- Non-array secrecy/integrity values default to empty labels
- Non-string description fields gracefully ignored
- Missing/nil/wrong-type resource key returns error
- Empty and nil items slices produce empty collections
- Multiple items with mixed label configurations
- LabeledData interface contract validation

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: github-actions[bot]