feat: parse request body for outgoing http

[giortzisg]

Description

This adds request and response parsing for outgoing http client spans.

Issues

Changelog Entry Instructions

To add a custom changelog entry, uncomment the section above. Supports:

• Single entry: just write text
• Multiple entries: use bullet points
• Nested bullets: indent 4+ spaces

For more details: custom changelog entries

Reminders

• Add GH Issue ID & Linear ID
• PR title should use conventional commit style (feat:, fix:, ref:, meta:)
• For external contributors: CONTRIBUTING.md, Sentry SDK development docs, Discord community

Changelog Entry

• Add ClientOptions.DataCollection for granular control over data collected by automatic instrumentation, replacing the broad SendDefaultPII switch. DataCollection can independently configure automatic user.* population, cookies, request/response headers, HTTP bodies, and query parameters. When configured, it is the source of truth and SendDefaultPII is ignored.
  • For backwards compatibility, clients that do not configure DataCollection keep a best-effort mapping of the previous SendDefaultPII behavior. To opt in to the new defaults, pass an empty DataCollection and then restrict individual categories as needed.

  sentry.Init(sentry.ClientOptions{
  	Dsn: "https://public@example.com/1",
  
  	// Opt in to the new data collection defaults. Omitted fields use their
  	// defaults: user info, cookies, headers, query params, and supported HTTP
  	// bodies are collected, with sensitive values filtered.
  	DataCollection: &sentry.DataCollection{},
  })

  • To opt in while disabling automatic user info and HTTP bodies, configure those fields explicitly:

  sentry.Init(sentry.ClientOptions{
  	Dsn: "https://public@example.com/1",
  	DataCollection: &sentry.DataCollection{
  		UserInfo:   sentry.Set(false),
  		HTTPBodies: []sentry.BodyType{},
  	},
  })

[github-actions]

Semver Impact of This PR

🟡 Minor (new features)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

---

New Features ✨

• Add ClientOptions.DataCollection for granular control over data collected by automatic instrumentation, replacing the broad SendDefaultPII switch. DataCollection can independently configure automatic user.* population, cookies, request/response headers, HTTP bodies, and query parameters. When configured, it is the source of truth and SendDefaultPII is ignored. by giortzisg in #1339
  • For backwards compatibility, clients that do not configure DataCollection keep a best-effort mapping of the previous SendDefaultPII behavior. To opt in to the new defaults, pass an empty DataCollection and then restrict individual categories as needed.

  sentry.Init(sentry.ClientOptions{
      Dsn: "https://public@example.com/1",
  
      // Opt in to the new data collection defaults. Omitted fields use their
      // defaults: user info, cookies, headers, query params, and supported HTTP
      // bodies are collected, with sensitive values filtered.
      DataCollection: &sentry.DataCollection{},
  })

  • To opt in while disabling automatic user info and HTTP bodies, configure those fields explicitly:

  sentry.Init(sentry.ClientOptions{
      Dsn: "https://public@example.com/1",
      DataCollection: &sentry.DataCollection{
          UserInfo:   sentry.Set(false),
          HTTPBodies: []sentry.BodyType{},
      },
  })

• PushScope shorthand now returns the new scope reference by DoctorJohn in #1335

Bug Fixes 🐛

• Isolate event processor across clones by giortzisg in #1337

Internal Changes 🔧

• Move limited buffer under utils by giortzisg in #1338

---

_{🤖 This preview updates automatically when you update the PR.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 52c44a1. Configure here.}

[sentry]

Bug: The logic for parsing Set-Cookie headers incorrectly joins multiple headers with "; " and then splits by ;, misinterpreting cookie attributes as cookie names.
_{Severity: MEDIUM}

Suggested Fix

Instead of joining multiple Set-Cookie headers with a semicolon, they should be handled individually. Iterate through the values slice from the header map. For each value (which represents a full Set-Cookie string like session=secret; Path=/), call FilterCookies on it separately and append the results. This will prevent cookie attributes from being incorrectly split and parsed as cookie names.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: httpclient/sentryhttpclient.go#L210

Potential issue: When processing multiple `Set-Cookie` response headers, the code joins
them with `"; "` before parsing. Since individual `Set-Cookie` headers use semicolons to
separate attributes (e.g., `Path`, `HttpOnly`), the subsequent split by `;` in
`FilterCookies` and `parseKeyValueString` causes these attributes to be misinterpreted
as cookie names. This results in corrupted and incorrect
`http.response.header.set-cookie` data on the Sentry span for any standard server
response that includes cookie attributes.