…y default, redaction and capture knobs (#136)

## Summary

Fills a factual gap surfaced while working ollygarden/skills#29:
`otel-java` had nothing on what Java HTTP instrumentation captures from
requests, so answering "does the agent export query strings, and how do
I stop it?" required external research. These are vendor-neutral
upstream facts and belong here.

New `references/sensitive-data-capture.md`, registered in the references
table:

- The default-capture asymmetry: headers, servlet request parameters,
and SQL bound values are **off** by default, but the raw query string
(`url.query` / inside `url.full`) is **on**, with only four credential
parameters redacted.
-
`otel.instrumentation.sanitization.url.experimental.sensitive-query-parameters`:
list semantics, **full-override** (not additive) behavior,
declarative-config name, and the removal of the old client-only
`redact-query-parameters` property
([#18229](open-telemetry/opentelemetry-java-instrumentation#18229)).
- The fact that **no property drops the query string entirely** —
post-processing options (SpanProcessor via autoconfigure SPI / agent
extension, or Collector `transform`/`redaction`).
- The opt-in capture knobs (header and servlet-parameter capture) and
current SQL-sanitization toggles with the deprecated spellings.
- Sources-of-truth fetch table (upstream HTTP config docs,
instrumentation `metadata.yaml`, CHANGELOG, semconv).

Every property name/default was verified against the upstream docs page,
an instrumentation `metadata.yaml`, and the CHANGELOG (fetch commands
are in the file's sources-of-truth table).

The companion opinion ("do not export query strings by default") lands
in `ollygarden-otel-java-setup` via ollygarden/skills#29, which
cross-references this file for mechanics — keeping opinions and upstream
facts separated per contributing guidelines.

## Agent involvement

Authored by an AI coding agent (Claude Code); reviewed and owned by
@jpkroehling.

## Harness results (required for new or substantively changed skills)

- **Prompt context:** Java showcase vibe run (2026-07-14,
spring-petclinic, openai/gpt-5.6-sol via opencode, hermetic harness) —
with the current `otel-java` skill installed and invoked, the agent
shipped instrumentation exporting `lastName=Owner58_88584` in
`url.query` (deterministic PII check FAIL, 2/40 Tempo traces); the skill
offered no capture/redaction facts to consult.
- **With this reference (micro-test, 2026-07-15):** a fresh hermetic
planning session with the updated skill set produced the
`sensitive_query_parameters` configuration block and an explicit
query-value redaction plan item, unprompted. Full A/B re-run
(`t3-vibe-java-r2`) follows once the paired opinion PR merges.
- Transcripts live in the (remote-less) showcase meta-repo `results/`;
available on request.

## Checklist

- [x] `skills-ref validate skills/otel-java` passes
- [x] Content is vendor-neutral upstream fact, verified against sources
of truth
- [x] Harness comparison results included above
- [x] Commit messages follow Conventional Commits
- [x] I have signed the OllyGarden CLA
- [x] I have read and will follow the Code of Conduct

🤖 Generated with [Claude Code](https://claude.com/claude-code)