fix(asgi): Gate query string and client IP behind send_default_pii

[ericapisani]

Move http.query and client.address attribute collection inside the
should_send_default_pii() check so sensitive values are not captured
by default.

Fixes PY-2514
Fixes#6499

[linear-code]

PY-2514

[ericapisani]

bugbot run
@sentry review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 666e6fb. Configure here.}

[github-actions]

Codecov Results 📊

✅ 89282 passed | ⏭️ 6013 skipped | Total: 95295 | Pass Rate: 93.69% | Execution Time: 301m 7s

📊 Comparison with Base Branch

Metric	Change
Total Tests	📈 +10
Passed Tests	📈 +10
Failed Tests	—
Skipped Tests	—

All tests are passing successfully.

✅ Patch coverage is 100.00%. Project has 2392 uncovered lines.
✅ Project coverage is 89.8%. Comparing base (base) to head (head).

Coverage diff

@@ Coverage Diff @@## main #PR +/-##
==========================================
+ Coverage 89.80% 89.80% —%
==========================================
Files 192 192 —
Lines 23453 23456 +3
Branches 8060 8062 +2
==========================================
+ Hits 21061 21064 +3- Misses 2392 2392 —- Partials 1329 1329 —

---

Generated by Codecov Action

[sentrivana]

If Warden is right about url.full not actually being the full URL, we should probably fix that as well (append ? + the query part?).

url.full is the base URL path with no query string — _get_url() docstring says it builds the URL "without also including the querystring" — so gating it behind should_send_default_pii() silently drops the request URL from all ASGI traces when PII is disabled, breaking basic HTTP observability.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit eb14dd0. Configure here.}