DataCollection phase 0: always redact sensitive header values

Part of getsentry/sentry-dotnet#5420. Phase 0 — hardening pre-work, no new public API.

Today only `Authorization` and `Proxy-Authorization` header values are redacted (`src/Sentry/Internal/RedactedHeaders.cs`, `SentryRequest.AddHeaders`, `Protocol/Response.AddHeaders`), and only in some paths. Apply the full sensitive-terms denylist filter to header **values** unconditionally — regardless of `SendDefaultPii` — in:

* `src/Sentry/SentryRequest.cs` / `src/Sentry/Protocol/Response.cs` (`AddHeaders`)
* `src/Sentry.AspNetCore/ScopeExtensions.cs` (request header capture)
* `src/Sentry.AspNet/Internal/SystemWebRequestEventProcessor.cs`
* `src/Sentry/SentryHttpFailedRequestHandler.cs` / `SentryGraphQLHttpFailedRequestHandler.cs`

Key names are kept; values become `[Filtered]`. Depends on the denylist/filter utility issue.

JS reference: [getsentry/sentry-javascript#18311]() (shipped standalone in 10.27.0, well before the option existed).

Start with src/Sentry/Internal/RedactedHeaders.cs and the denylist/filter utility issue, then trace AddHeaders in src/Sentry/SentryRequest.cs and src/Sentry/Protocol/Response.cs. Review request capture in src/Sentry.AspNetCore/ScopeExtensions.cs, src/Sentry.AspNet/Internal/SystemWebRequestEventProcessor.cs, and the failed-request handlers. Done means sensitive header values are [Filtered] in every listed path regardless of SendDefaultPii, while header names remain unchanged.

Written by the indexing model from the issue text.