[OpenTelemetry] Support configuring sensitive URL query parameters

ASP.NET Core uses a fixed list of sensitive query parameters whose values are replaced with `REDACTED` in the OpenTelemetry `url.query` attribute.

Support overriding this list through the OpenTelemetry-aligned environment variable:
`OTEL_INSTRUMENTATION_SANITIZATION_URL_EXPERIMENTAL_SENSITIVE_QUERY_PARAMETERS` (the same precedent as for known http methods. _We may expose configuration via public api as well_)

The value should be a comma-separated, case-sensitive list that completely replaces the built-in defaults, matching OpenTelemetry's `sensitive_query_parameters` contract.

When the variable is absent, ASP.NET Core should continue using its built-in list. `Microsoft.AspNetCore.Hosting.SuppressActivityUrlQuery` should continue to suppress the `url.query` attribute entirely.

Start by finding the existing configuration for known HTTP methods and the URL query sanitization path in ASP.NET Core. Check how OTEL_INSTRUMENTATION_SANITIZATION_URL_EXPERIMENTAL_SENSITIVE_QUERY_PARAMETERS should replace the defaults, then verify absent-variable behavior, case-sensitive comma-separated values, and continued suppression through Microsoft.AspNetCore.Hosting.SuppressActivityUrlQuery.

Written by the indexing model from the issue text.