Additional targeting attributes.

The built-in evaluation path accepts these but does not read them — only userId participates in allowlist and percentage targeting. They are carried through for a custom provider that implements its own targeting rules.