[Feat][SDK-601] Add built in scrubbing

[buongarzoni]

Description of the change

Adds a scrubbing layer that runs on every payload, so sensitive data is redacted by default rather than only when a user wires up their own transformer.

What it does

ScrubDataTransformer runs after any user-supplied transformer and cannot be
bypassed by replacing it. It redacts values with *** in:

• Request headers — via a built-in deny-list (Authorization, Cookie,
  Set-Cookie, X-Api-Key, X-Auth-Token, X-Access-Token, X-Secret,
  Proxy-Authorization, WWW-Authenticate). Always on, no config needed.
• Query params, POST params, custom data, and Frame.locals — for keys
  matching the new redactedKeys config. Nested custom maps are traversed to a
  depth of 8.

Request.url is sanitized unconditionally by DefaultUrlSanitizer, which strips
userinfo, query string, and fragment.

Config

ConfigBuilder.withAccessToken(TOKEN)
    .redactedKeys(Arrays.asList("password", "token", "secret"))  // case-insensitive regex
    .urlSanitizer(myCustomSanitizer) // optional
    .build();

Added to both the core and reactive-streams builders. Defaults are an empty
redaction list and DefaultUrlSanitizer.

Warning

Behavior change
Query strings are now stripped from Request.url by default. Users who relied on
seeing them in Rollbar will need a custom urlSanitizer.

okhttp

RollbarOkHttpInterceptor now delegates its default URL sanitization to the
shared DefaultUrlSanitizer so the okhttp and notifier paths can't drift apart,
and gains a withSharedUrlSanitizer(recorder, sanitizer) factory to reuse the
sanitizer from a notifier config.

The sanitizer types live in rollbar-api (com.rollbar.api.scrubbing), not
rollbar-java, so rollbar-okhttp keeps its existing lightweight dependency.
The factory is static rather than a constructor overload — UrlSanitizer and
StringUrlSanitizer are both functional interfaces, so an overload would make a
lambda argument ambiguous and break existing callers at compile time.

Type of change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Maintenance
• New release

Related issues

Shortcut stories and GitHub issues (delete irrelevant)

• Fix [SC-]
• Fix Remove GSON Dependency #1

Checklists

Development

• Lint rules pass locally
• The code changed/added as part of this pull request has been covered with tests
• All tests related to the changed code pass in development

Code review

• This pull request has a descriptive title and information useful to a reviewer. There may be a screenshot or screencast attached
• "Ready for review" label attached to the PR and reviewers assigned
• Issue from task tracker has a link to this pull request
• Changes have been reviewed by at least one other engineer

[linear-code]

SDK-601

[buongarzoni]

@claude review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 52d5d40da7

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[brianr]

The always-last transformer and copy-on-write implementation are a good foundation, and the current head fixes the earlier routing-param, metadata, encoded-query-key, and JVMTI thread-local gaps. I am requesting changes for the two remaining payload paths called out inline. Before release, this behavior change also needs user-facing migration documentation plus an integration test proving transformer ordering/reconfiguration (including the reactive builder) and the shared OkHttp sanitizer path.

[brianr]

[P1] Traverse collections and arrays when scrubbing nested data

This only descends into values that are directly Map instances. Valid payloads such as custom = {"users": [{"password": "hunter2"}]} therefore ship the configured secret unchanged. The serializer supports both Collection and Object[], and the same bypass applies to nested values in Request.post, Request.metadata, and Frame.locals. Please recursively scrub maps contained in collections/arrays under the same depth cap, preserve the surrounding shape, and add regression tests for both forms.

[brianr]

[P1] Sanitize URLs in network telemetry events

RollbarBase.recordNetworkEventFor(...) passes its URL directly to the tracker, which stores it unchanged. Those events are later carried in Body.telemetryEvents, but scrubBody() only rebuilds trace content and thread traces. A caller can therefore record https://user:pass@example.com/path?token=secret and ship both userinfo and query string despite the built-in scrubber. Please apply the configured sanitizer before recording network telemetry, or rebuild network telemetry events here, and cover the public notifier API with a regression test.

[brianr]

One additional security issue on the current head.

[brianr]

[P1] Seed field scrubbing with a meaningful default list

When redactedKeys is unset, this stores an empty list, so ScrubDataTransformer leaves GET/POST parameters, request.query_string, custom data, metadata, and Frame.locals untouched. Stripping the query from request.url does not close that gap: the web request provider serializes parsed GET parameters and the raw query string separately, so /login?password=hunter2 still sends hunter2 under both request.get.password and request.query_string with the default configuration.

That means the default behavior only protects the built-in header deny-list and URL strings; it does not satisfy the stated goal that sensitive data is redacted by default. Please seed this with an additive built-in field list (for example password/passwd, secret, token/access_token, auth/authentication/authorization), ideally with an explicit override mechanism, and add a no-configuration end-to-end test proving the secret is absent from every relevant request representation.