DataCollection phase 4: spec defaults for explicit DataCollection users

Part of #5420. Phase 4 — defaults flip (minor release).

Confirm/enable the spec defaults for users who explicitly set `DataCollection`:

- `UserInfo = true`, `HttpBodies = All` (four directions), denyList behaviors for cookies/headers/query params, `FrameContextLines = 5`.
- `MaxRequestBodySize` continues to govern body *size* (integration precedence).
- Behavior-neutral for everyone who has not set `DataCollection` (they stay on the `SendDefaultPii` bridge).
- Changelog callout documenting that `DataCollection = new()` is more permissive than `SendDefaultPii = false`, with the opt-out block.

JS references: getsentry/sentry-javascript#21348, #21352 (10.57.0 defaults flip gated on explicit opt-in).

No .NET files or tests are named. Start by tracing the DataCollection and SendDefaultPii configuration paths, then compare the behavior with the referenced sentry-javascript issues. Done means the explicit-user defaults, body-size precedence, unchanged bridge behavior for other users, opt-out block, and changelog callout are verified.

Written by the indexing model from the issue text.