fn build_splunk_body(entries: &[Value], time: f64, source: &str) -> Bytes
Serializes a batch into the HEC request body: HEC accepts multiple JSON event objects concatenated with no separator. Factored out for unit testing.