Capture all repeated `Cookie` and `Set-Cookie` header values

Bắt đầu bằng cách kiểm tra các đường dẫn hiện có để trích xuất cookie và truy cập header trong các tích hợp OkHttp, Ktor, Apollo 3 và Apollo 4, sau đó so sánh cách các SDK khác xử lý các header lặp lại. Theo dõi chính sách cookie dùng chung và hành vi khi thiếu Data-Collection trước khi chạy các bài kiểm thử tích hợp. Hoàn thành có nghĩa là các giá trị Cookie và Set-Cookie lặp lại được bao phủ mà không xử lý dấu phẩy không an toàn, việc lọc vẫn hiệu quả và các giá trị không hợp lệ fail closed.

Problem

The OkHttp, Ktor, and Apollo integrations capture only one Cookie or Set-Cookie header value when creating request and response contexts. Their current header accessors select a single value, so additional cookie fields are omitted from Sentry telemetry.

This is valid HTTP behavior. In particular, HTTP/2 allows clients to split the Cookie field into multiple header fields for compression. Responses also commonly contain multiple Set-Cookie fields.

This is follow-up completeness work from #5811 and supports #5666.

Check what other SDKs are doing before implementing.

Proposed solution

Make cookie extraction list-aware across OkHttp, Ktor, Apollo 3, and Apollo 4:

• Combine repeated request Cookie fields with ; before applying the effective cookie policy.
• Process each response Set-Cookie field independently because each field represents one cookie and its attributes.
• Do not comma-join or comma-split Set-Cookie values. A valid Expires attribute contains a comma.
• Add shared core helpers or integration-specific adapters that apply the effective cookie policy to every value.
• Preserve valid Set-Cookie attributes and fail closed for malformed input.

Preserve the existing absent-Data-Collection compatibility behavior for each integration.

Acceptance criteria

• OkHttp, Ktor, Apollo 3, and Apollo 4 capture all repeated cookie header values supported by their header APIs.
• Multiple request Cookie fields are combined with ; and filtered as one cookie string.
• Multiple response Set-Cookie fields are filtered independently without comma splitting or joining.
• Built-in sensitive-cookie filtering and configured allow-list, deny-list, and off behavior apply to every cookie value.
• Malformed cookie values never bypass filtering.
• Integration tests cover at least two request Cookie fields and two response Set-Cookie fields where the underlying header API supports repeated values.