Merge commit from fork

* fix(instrumentation-http): redact sensitive query params on server spans

Sensitive query parameters (sig, Signature, AWSAccessKeyId,
X-Goog-Signature) were redacted on outgoing client spans via
getAbsoluteUrl() but were written verbatim to url.query on incoming
server spans. Explicitly configuring redactedQueryParams had no effect
on server spans, making the documented mitigation silently inert.

- Extract redactQueryString() helper shared by both paths
- Apply redaction in getIncomingRequestAttributes() defaulting to the
  same built-in list as the client path
- Add redactedQueryParamsServer config option for independent per-side
  control; set to [] to opt out of server-side redaction

Fixes GHSA-3v2p-hm54-8qcq

* Update experimental/CHANGELOG.md

Co-authored-by: Marc Pichler <marc.pichler@dynatrace.com>

* apply review comments

* Document sensitive query parameter redaction

* fix(instrumentation-http): use has() to redact duplicate and empty query params

* Update experimental/packages/opentelemetry-instrumentation-http/src/types.ts

Co-authored-by: Jamie Danielson <jamiedanielson@honeycomb.io>

* fix(instrumentation-http): accept URLSearchParams in redactQueryString to avoid redundant URL parsing

---------

Co-authored-by: Marc Pichler <marc.pichler@dynatrace.com>
Co-authored-by: Jamie Danielson <jamiedanielson@honeycomb.io>