New Adapter: Tunnl

[BahadirIren]

Type of change

• New bidder adapter

Description of change

Adds a Prebid Server bid adapter for Tunnl.

Tunnl serves one endpoint per region and media type, so an impression declaring
more than one media type is split into a separate request per media type and the
responses are merged.

The adapter takes no publisher parameters — the endpoint is fully determined by
host config plus the impression's media type, so static/bidder-params/tunnl.json
is an empty schema. The default endpoint targets the US region; hosts elsewhere
override adapters.tunnl.endpoint with the line for their region listed in the
yaml comment.

Other information

Docs PR: prebid/prebid.github.io#6690

[BahadirIren]

Heads up: the Adapter Semgrep Check job fails with

Refusing to check out fork PR code from a 'pull_request_target' workflow.

This is the known actions/checkout "pwn request" restriction affecting every
fork PR that touches adapters/*/*.go — not something in this change. #4894
already fixes it by splitting the check into untrusted pull_request and trusted
workflow_run stages.

Locally ./validate.sh --nofmt --race 10 passes and the adapter is clean against
the .semgrep/adapter rules, so both checks should be green once that lands.

Could #4894 be prioritised? It's currently blocking the semgrep check on all
incoming adapter PRs, not just this one. Happy to rebase afterwards.