DataCollection phase 0: scrub sensitive URL query parameters

Part of getsentry/sentry-dotnet#5420. Phase 0 — hardening pre-work, no new public API.

Query strings are captured **unconditionally and unscrubbed** today:

* `src/Sentry.AspNetCore/ScopeExtensions.cs:136` — `scope.Request.QueryString = context.Request.QueryString`
* `src/Sentry.AspNet/Internal/SystemWebRequestEventProcessor.cs:50`

Apply the sensitive-terms denylist to query parameter values (keys preserved, values → `[Filtered]`; unparseable query string → `[Filtered]` wholesale). This is privacy hardening in its own right — an `?access_token=...` or `?session_id=...` currently reaches Sentry in clear text.

Depends on the denylist/filter utility issue.

Start with src/Sentry.AspNetCore/ScopeExtensions.cs:136 and src/Sentry.AspNet/Internal/SystemWebRequestEventProcessor.cs:50, then review the denylist/filter utility once available. Apply it to query parameter values while preserving keys, use [Filtered] for values or an unparseable query string, and verify both request-processing paths no longer capture sensitive values unchanged.

Written by the indexing model from the issue text.