DataCollection phase 0: parse cookies individually and filter sensitive cookie names

Part of getsentry/sentry-dotnet#5420. Phase 0 — hardening pre-work, no new public API.

Cookie capture is currently all-or-nothing: the raw `Cookie` header string is attached wholesale when `SendDefaultPii` is true (`src/Sentry/HttpHeadersExtensions.cs` `GetCookies`, `src/Sentry.AspNetCore/ScopeExtensions.cs`, `src/Sentry.AspNet/HttpContextExtensions.cs`, `SystemWebRequestEventProcessor.cs`, failed-request handlers).

Change to:

* Parse the cookie header into individual name/value pairs.
* Filter values of sensitive cookie names via the shared denylist utility (including the cookie-specific name terms).
* If the cookie string is unparseable, replace it entirely with `[Filtered]` (per spec).

Depends on the denylist/filter utility issue.

JS references: [getsentry/sentry-javascript#18325]() (per-cookie parsing, 10.31.0), [getsentry/sentry-javascript#20485]() (expanded cookie-name filtering, 10.50.0).

Start with src/Sentry/HttpHeadersExtensions.cs and its GetCookies method, then trace cookie handling through src/Sentry.AspNetCore/ScopeExtensions.cs, src/Sentry.AspNet/HttpContextExtensions.cs, SystemWebRequestEventProcessor.cs, and the failed-request handlers. Read the shared denylist/filter utility dependency before changing these paths. Done means cookies are parsed individually, sensitive names are filtered, and an unparseable cookie string becomes [Filtered].

Written by the indexing model from the issue text.