DataCollection phase 0: parse cookies individually and filter sensitive cookie names

[jamescrosswell]

Part of #5420. Phase 0 — hardening pre-work, no new public API.

Cookie capture is currently all-or-nothing: the raw Cookie header string is attached wholesale when SendDefaultPii is true (src/Sentry/HttpHeadersExtensions.cs GetCookies, src/Sentry.AspNetCore/ScopeExtensions.cs, src/Sentry.AspNet/HttpContextExtensions.cs, SystemWebRequestEventProcessor.cs, failed-request handlers).

Change to:

• Parse the cookie header into individual name/value pairs.
• Filter values of sensitive cookie names via the shared denylist utility (including the cookie-specific name terms).
• If the cookie string is unparseable, replace it entirely with [Filtered] (per spec).

Depends on the denylist/filter utility issue.

JS references: getsentry/sentry-javascript#18325 (per-cookie parsing, 10.31.0), getsentry/sentry-javascript#20485 (expanded cookie-name filtering, 10.50.0).

[linear-code]

NET-758