PR Stack (Data Collection)

• feat(core): Data Collection #5759
• feat(core): [Data Collection 1] Add configuration types #5760
• feat(core): [Data Collection 2] Expose SentryOptions API #5761
• feat(core): [Data Collection 3] Add policy resolver #5799
• feat(graphql): [Data Collection 4] Apply GraphQL policies #5800
• feat(database): [Data Collection 5] Apply query policy #5801
• feat(spring): [Data Collection 6] Apply incoming request body policy #5802
• feat(apollo): [Data Collection 7] Apply incoming response body policy #5803
• feat(apollo): [Data Collection 8] Apply outgoing request body policy #5804
• feat(graphql): [Data Collection 9] Apply outgoing response body policy #5805
• feat(http): [Data Collection 10] Apply request header policy #5806
• feat(http): [Data Collection 11] Apply response header policy #5807
• feat(http): [Data Collection 12] Apply query parameter policy #5810
• feat(http): [Data Collection 13] Apply cookie collection policy #5811
• feat(user): [Data Collection 14] Apply user information policy #5812
• fix(android): [Data Collection 15] Scope device info cache to SDK options #5831
• test(replay): [Data Collection 16] Keep Replay independent #5832
• fix(spring): [Data Collection 18] Bind key-value policies #5834
• fix(android): [Data Collection 19] Preserve installation ID #5937
• fix(ktor): [Data Collection 20] Exclude query parameters from span descriptions #5983
• feat(core): [Data Collection 21] Add external configuration #6036
• feat(android): [Data Collection 22] Add manifest configuration #6038
• fix(core): [Data Collection 23] Support WebSocket URL parsing #6064
• fix(core): [Data Collection 24] Narrow utility exception handling #6065
• feat(core): [Data Collection 25] Apply file path policy #6075
• feat(logback): [Data Collection 26] Add unencoded message opt-in #6076
• fix(core): [Data Collection 27] Make opt-in explicit #6122

📜 Description

Apply the query-parameter Data Collection policy to Sentry-owned automatic HTTP request data, spans, breadcrumbs, and failed-request events.

The policy is used by Servlet, Spring MVC/WebFlux, OkHttp, Ktor, Apollo 2/3/4, OpenFeign, RestTemplate, and WebClient. Explicit Data Collection supports off, deny-list, and allow-list behavior. Built-in sensitive parameter names are always filtered, including when allow-listed. Encoded parameter names are decoded for matching while the original query encoding is retained.

When Data Collection is absent, integrations continue to attach raw query values as before. Completed OpenTelemetry attributes also retain their existing values because the exporter cannot distinguish manually supplied attributes from values added by auto-instrumentation.

💡 Motivation and Context

Query strings collected by Sentry-owned automatic instrumentation need a dedicated privacy control. This wires dataCollection.urlQueryParams into those Java HTTP integration paths while preserving the legacy bridge for applications that have not configured Data Collection.

Refs #5666

💚 How did you test it?

• ./gradlew spotlessApply apiDump
• ./gradlew :sentry:apiCheck
• Core resolver, URL, and query-filter tests
• Servlet query tests
• OkHttp query integration test
• ./gradlew :sentry-opentelemetry:sentry-opentelemetry-core:test --tests '*OpenTelemetryAttributesExtractorTest'
• Full Ktor, Apollo 2/3/4, OpenFeign, Spring, Spring Jakarta, and Spring 7 test suites
• git diff --check

📝 Checklist

• I added GH Issue ID & Linear ID
• I added tests to verify the changes.
• No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
• I updated the docs if needed.
• I updated the wizard if needed.
• Review from the native team if needed.
• No breaking change or entry added to the changelog.
• No breaking change for hybrid SDKs or communicated to hybrid SDKs.
• Public API changes reviewed by another Mobile SDK team member or implemented according to the develop docs spec.

🔮 Next steps

Migrate cookie collection and complete the remaining Data Collection configuration and integration work.

#skip-changelog

⚠️ Merge this PR using a merge commit (not squash). Only the collection branch is squash-merged into main.