What does this PR do?

Makes Redactor#normalize strip a leading http_ so that Rack CGI
header keys (HTTP_AUTHORIZATION, HTTP_COOKIE, HTTP_X_API_KEY,
…) collapse to the same identifier as the bare header name and are
matched against DEFAULT_REDACTED_IDENTIFIERS (authorization,
cookie, xapikey, …).

Motivation

Rack rewrites incoming HTTP header names to the CGI form HTTP_<HEADER>
(dashes to underscores, HTTP_ prefix). The previous normalize
implementation stripped only [-_$@], so Rack-shaped keys collapsed to
httpauthorization, httpcookie, httpxapikey, etc., and no entry in
the default identifier list matched them. Any hash capture that
included a Rack env (every Rack-based middleware, Rails controller,
or Sinatra handler keeps it in lexical scope) ended up emitting those
values verbatim into the snapshot, while the same headers under their
bare names (Authorization, Cookie, X-API-Key) were redacted.
Snapshots should not distinguish between env["HTTP_AUTHORIZATION"]
and a local authorization — both name the same thing.

The change is in normalize rather than DEFAULT_REDACTED_IDENTIFIERS
because the list is shared across tracers and the gap is structural:
every entry in the list has an HTTP_-prefixed twin under Rack, and
maintaining the twin in lockstep is more error-prone than collapsing
the prefix at normalization time. The strip runs after downcase and
is anchored to \Ahttp_, so identifiers that simply start with the
letters http without a following underscore (e.g. httpinfo) are
unaffected. User-supplied identifiers go through the same path, so a
user-defined http_custom entry now also matches the bare custom
form — the same collapsing already applies to the punctuation gsub
(pass_word matches password), and this extends the principle to
the Rack prefix.

Change log entry

Yes. Dynamic Instrumentation: redactor normalizes the Rack CGI header
prefix (HTTP_<HEADER>), so snapshot captures of a Rack environment
redact sensitive header values under the same defaults as their bare
header names.

Implementation

Redactor#normalize becomes:

str.to_s.strip.downcase.sub(/\Ahttp_/, "").gsub(/[-_$@]/, "")

The sub runs once at normalization time; there is no per-lookup
cost beyond a single anchored regex check on already-downcased input.
Both the default list and the user-defined / excluded lists are
normalized with the same function (see the redacted_identifiers
private method), so the prefix strip applies symmetrically — a name
excluded via redaction_excluded_identifiers continues to suppress
redaction regardless of whether the captured key is the bare form or
the HTTP_-prefixed form.

How to test the change?

bundle exec rspec spec/datadog/di/redactor_spec.rb

49 examples, 0 failures.

bundle exec rake test:di:di_with_ext

808 examples, 0 failures, 8 pending (same 8 Ruby-version-gated pending
tests as on master).

New spec cases live under describe '#redact_identifier?' and cover:

• HTTP_AUTHORIZATION, HTTP_COOKIE, HTTP_X_API_KEY,
  HTTP_X_AUTH_TOKEN, HTTP_SET_COOKIE — all match their bare
  counterparts in DEFAULT_REDACTED_IDENTIFIERS
• HTTP_REFERER, HTTP_HOST — Rack-shaped but not in the list;
  pass through unredacted as controls
• httpinfo — boundary case proving the prefix strip is anchored to
  the literal CGI form (leading http_), not arbitrary identifiers
  that begin with the letters http
• HTTP_CUSTOM and custom against a user-defined http_custom
  entry — confirms the user-defined list normalizes through the same
  function