Keep the request and the user out of Sentry events

[gustavofreze]

Please follow the contributing guidelines.

Summary

SentryReporter::initializedWith booted the SDK with its defaults, and the PHP SDK defaults to
max_request_body_size=medium. Its request integration reads the request from the globals of the process and
attaches the URL with the query string, the headers, and a body of up to 10 KB. send_default_pii=false filters the
Authorization and Cookie headers and the IP address, and nothing else. A server error on a login route therefore
sent the email and the password to the project.

Measured with a local capture of the envelope, SDK 4.32.0 on PHP 8.5, for a POST /v1/auth/login?phone=... carrying a
JSON body and a bearer token, answered with 500:

In the envelope	2.0.0	This branch
Password from the body	present	absent
Email from the body	present	absent
Phone from the query string	present	absent
Bearer token	[Filtered]	absent
request object	present	absent
The exception	present	present

The reporter now boots the SDK with max_request_body_size=never, so the body is never read, and with a before_send
hook that drops the request and the user the SDK gathered on its own. The method and the path an event needs
already travel in the http context, and the matched route in the transaction. SentryReporter::from() is unchanged,
because a hub the application boots is the application's to configure, and the README now says so.

Related issue

None. Found while wiring the reporter into more services.

Checklist

• Tests added or updated. Two new test methods: the options the SDK is booted with, and the hook stripping an event
  that carries a login request and a user.
• Documentation updated when applicable. README section "Reporting errors to Sentry".
• make review passes.
• make tests passes: 130 tests, 266 assertions, 203 mutants, all killed, MSI 100%.