feat: configurable event scrubber chain and data minimization options

[gradinarufelix]

Adds a configurable event scrubber chain so integrators can remove or redact data from events before they leave the server — our use case is GDPR data minimization for privacy-sensitive customers, where request bodies, query strings, IPs and email addresses must not reach Sentry.

Stacked on #52, #53 and #54 (their commits are included here); marked draft until those land, then this rebases to the scrubbing commit only.

Mechanism

• EventScrubberInterface::scrub(Event $event, ?EventHint $hint): ?Event — may mutate, replace, or return null to discard.
• Explicit registration via settings, keyed by a stable identifier:

Flownative:
  Sentry:
    scrubbers:
      'Acme.Request':
        className: 'Flownative\Sentry\Scrubbing\RequestScrubber'
        position: 100
        options:
          queryParamAllowlist: ['search']

• Positions use Flow's PositionalArraySorter; entries are disabled with ~. The whole chain is validated and instantiated at boot, so misconfiguration fails the deployment instead of surfacing as a runtime scrubbing failure.
• Composed into before_send, before_send_transaction and before_send_check_in, after the existing exception excludes.
• Fail-closed + fail-loud: if a scrubber throws, the event is discarded and a synthetic, built-from-scratch replacement event is sent (scrubber ID, normalized class names, integer exception code, discarded event ID — nothing derived from the failed event), so scrubbing failures stay visible in Sentry instead of degrading silently.

Bundled scrubbers

• RequestScrubber — keep-only request interface (method, URL, query string, headers); query string filtered against an allowlist without parse_str() (repeated params and raw encoding survive), fragments dropped, body/cookies/env always removed; also filters breadcrumb URLs.
• ValuePatternScrubber — named built-in patterns (url-credentials with scheme allowlist, email, ipv4, ipv6, iban, phone) applied literally via callback across messages, exception values, breadcrumbs, extras, contexts, tags, fingerprints, transaction names, spans and check-in slugs; canonicalized sensitive-key redaction (api_key/api-key/X-Api-Key); objects are replaced without serializing their content. The user interface is deliberately untouched.
• FrameVarsScrubber — strips frame vars, relativizes absolute file paths, normalizes anonymous-class path segments.
• SpanDataScrubber — drops span data values, removes URL query strings from transaction names/span descriptions/span tags (SQL ? placeholders survive).

Data-minimization toggles (defaults preserve current behavior)

attachSessionTag, attachProcessInfo, captureStacktraceVariables (also gates debug_backtrace() args for message events), userContext: service|username|sha1|none (none also removes a scope user set by foreign code via Scope::removeUser()).

Notes for review

• Settings schema included; PHPUnit suite (46 tests) covers the scrubbers, the chain, boot validation and client-level integration via ClientBuilder with an in-memory transport (verified against sentry/sentry 4.30.0 — e.g. Span::setData() merge semantics are accounted for).
• SDK floor stays ^4.0; before_send_check_in and some setters were only verified against 4.30. Happy to raise the floor or add a CI matrix if you prefer.
• Naming (scrubbers / EventScrubberInterface) and the reserved-options list from feat: add sdkOptions passthrough for Sentry SDK client options #52 are open to bikeshedding.