refa(plug): consolidate access to the plug scrubber

[solnic]

This encapsulates scrub-related logic fully in the Sentry.Scrubber and expands its interface to make it easily usable standalone and introduces a "current scrubber" concept, so that customized scrubbers are actually respected and used across processes.

This will also make it simpler to implement the new spec that replaces "default PII" concept later this year.

The public API remains the same, which means that plug options accept the same keys which result in the same behavior and the original default scrubbing functions are still there (PlugContext.default_*_scrubber ones). To be honest, I'd deprecate them and shift entire scrubbing stuff to the Scrubber eventually. Something to consider.

These improvements make fixes here #1068 and here #1070 trivial, which is the actual biggest reason why I've done this.

Basic examples

Sentry.Scrubber.scrub(%{password: "super-secret", custom_secret: "HIDE PLZZZ"}, keys: [:password, :custom_secret])
#=> %{password: "*********", custom_secret: "*********"}

# Falls back to the default keys (["password", "passwd", "secret"]) when none given
Sentry.Scrubber.scrub(%{"password" => "hunter2", "name" => "Jane"})
#=> %{"password" => "*********", "name" => "Jane"}

# Recurses into nested maps/lists; credit-card-shaped values are caught too
Sentry.Scrubber.scrub(%{user: %{name: "Jane", password: "hunter2"}, tokens: ["4111 1111 1111 1111"]}, keys: [:password])
#=> %{user: %{name: "Jane", password: "*********"}, tokens: ["*********"]}

Web-related scrubbing helpers

Sentry.Scrubber.scrub_query_string("user=jane&password=hunter2")
#=> "user=jane&password=%2A%2A%2A%2A%2A%2A%2A%2A%2A"

Sentry.Scrubber.scrub_url("https://example.com/login?token=abc&secret=xyz", keys: ["secret"])
#=> "https://example.com/login?token=abc&secret=%2A%2A%2A%2A%2A%2A%2A%2A%2A"

Sentry.Scrubber.drop_keys(%{"authorization" => "Bearer x", "accept" => "json"})
#=> %{"accept" => "json"}

Stored scrubber instance

This stuff is used internally by the PlugContext:

# Register per-field scrubbers for the request
Sentry.Scrubber.put_conn_scrubber(
  body_scrubber: &MyScrubber.scrub_params/1,
  header_scrubber: {MyScrubber, :scrub_headers},
  cookie_scrubber: nil
)
#=> :ok

# Scrub a conn's params, headers, and cookies using the registered scrubbers
Sentry.Scrubber.scrub(conn)
#=> %Plug.Conn{params: %{"password" => "*********", ...}, ...}

# The URL is not a conn field — fetch its scrubber and apply it separately
Sentry.Scrubber.get(:url_scrubber).(conn)
#=> "https://example.com/login?secret=*********"