PR Stack (Data Collection)

• feat(core): Data Collection #5759
• feat(core): [Data Collection 1] Add configuration types #5760
• feat(core): [Data Collection 2] Expose SentryOptions API #5761
• feat(core): [Data Collection 3] Add policy resolver #5799
• feat(graphql): [Data Collection 4] Apply GraphQL policies #5800
• feat(database): [Data Collection 5] Apply query policy #5801
• feat(spring): [Data Collection 6] Apply incoming request body policy #5802
• feat(apollo): [Data Collection 7] Apply incoming response body policy #5803
• feat(apollo): [Data Collection 8] Apply outgoing request body policy #5804
• feat(graphql): [Data Collection 9] Apply outgoing response body policy #5805
• feat(http): [Data Collection 10] Apply request header policy #5806
• feat(http): [Data Collection 11] Apply response header policy #5807
• feat(http): [Data Collection 12] Apply query parameter policy #5810
• feat(http): [Data Collection 13] Apply cookie collection policy #5811
• feat(user): [Data Collection 14] Apply user information policy #5812
• fix(android): [Data Collection 15] Scope device info cache to SDK options #5831
• test(replay): [Data Collection 16] Keep Replay independent #5832
• fix(spring): [Data Collection 18] Bind key-value policies #5834
• fix(android): [Data Collection 19] Preserve installation ID #5937
• fix(ktor): [Data Collection 20] Exclude query parameters from span descriptions #5983
• feat(core): [Data Collection 21] Add external configuration #6036
• feat(android): [Data Collection 22] Add manifest configuration #6038
• fix(core): [Data Collection 23] Support WebSocket URL parsing #6064
• fix(core): [Data Collection 24] Narrow utility exception handling #6065
• feat(core): [Data Collection 25] Apply file path policy #6075
• feat(logback): [Data Collection 26] Add unencoded message opt-in #6076
• fix(core): [Data Collection 27] Make opt-in explicit #6122

📜 Description

Apply the request-header Data Collection policy across Servlet, Spring MVC and WebFlux, OkHttp, Ktor, and Apollo 3/4 automatic instrumentation.

Explicit Data Collection supports off, deny-list, and allow-list behavior with canonical sensitive-key filtering. When Data Collection is absent, each integration retains its previous sendDefaultPii and legacy sensitive-header behavior.

Completed OpenTelemetry attributes retain their existing behavior because the exporter cannot distinguish manually supplied attributes from values added by auto-instrumentation.

💡 Motivation and Context

Request header collection historically differs by integration. A shared filter provides specification behavior for opted-in applications without changing existing applications that continue to use legacy configuration.

Refs #5666

💚 How did you test it?

• ./gradlew spotlessApply apiDump
• Full relevant core, Servlet, Spring, OkHttp, Ktor, Apollo 3, and Apollo 4 tests
• ./gradlew :sentry-opentelemetry:sentry-opentelemetry-core:test --tests '*OpenTelemetryAttributesExtractorTest'
• ./gradlew apiCheck

📝 Checklist

• I added GH Issue ID & Linear ID
• I added tests to verify the changes.
• No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
• I updated the docs if needed.
• I updated the wizard if needed.
• Review from the native team if needed.
• No breaking change or entry added to the changelog.
• No breaking change for hybrid SDKs or communicated to hybrid SDKs.

🔮 Next steps

Apply the response-header policy and migrate cookies separately.

#skip-changelog

⚠️ Merge this PR using a merge commit (not squash). Only the collection branch is squash-merged into main.