[Corehttp] Add tracing query param sanitization

[pvaneck]

This adds sanitization to URL query parameters that are set as span attributes.

Port of: #46482

[Copilot]

Pull request overview

This PR makes corehttp tracing safer by default by sanitizing URL query parameter values before recording them as span attributes, while still allowing users to opt-in specific query parameters to remain visible.

Changes:

• Add sanitize_url utility to redact non-allowlisted query parameter values (default placeholder REDACTED).
• Introduce additional_allowed_query_params on DistributedHttpTracingPolicy, with a default allowlist including api-version.
• Add CaseInsensitiveSet to support case-insensitive allowlist checks and expand/update tests and changelog accordingly.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
sdk/core/corehttp/corehttp/runtime/policies/_distributed_tracing.py	Sanitizes url.full span attribute and adds allowlist configuration via additional_allowed_query_params.
sdk/core/corehttp/corehttp/runtime/policies/_utils.py	Adds sanitize_url helper used by tracing to redact query parameter values.
sdk/core/corehttp/corehttp/utils/_utils.py	Adds CaseInsensitiveSet used for case-insensitive allowlist membership checks.
sdk/core/corehttp/tests/test_utils.py	Adds unit tests for sanitize_url and CaseInsensitiveSet.
sdk/core/corehttp/tests/test_tracing_policy.py	Updates existing tracing assertions and adds new tests validating default/custom sanitization behavior.
sdk/core/corehttp/CHANGELOG.md	Documents the new tracing allowlist knob and the default sanitization behavior change.