[internal] WebSocket telemetry needs path-redaction control #13

Requesting repo: gsmlg-dev/gsmlg_umbrella on branch codex/remote-browser-control

What is needed and why

http_web_socket emits the complete %URI{} as metadata.url for connect, message, and close telemetry. Remote browser-control WebSocket paths contain the CloakBrowser profile and opaque CDP target identifier, so even with no query or userinfo a telemetry subscriber can persist remote-only control material. Existing issue #12 covers query/userinfo credentials, but its minimum proposed redaction retains the path and therefore does not cover CDP target URLs.

The caller needs a supported option to omit metadata.url entirely or emit a caller-supplied redacted telemetry URI/path while the connection and handshake continue to use the real URI.

Minimal reproduction

:telemetry.attach(
  "capture-cdp-url",
  [:http_web_socket, :connect, :start],
  fn _, _, metadata, owner -> send(owner, metadata.url) end,
  self()
)

HTTP.WebSocket.new(
  "ws://127.0.0.1:8080/api/profiles/profile-123/cdp/devtools/page/opaque-target-id",
  [],
  headers: [{"authorization", "Bearer secret"}]
)

receive do
  uri -> IO.inspect(uri)
end

Observed telemetry contains /api/profiles/profile-123/cdp/devtools/page/opaque-target-id.

Expected behavior

Provide a fail-closed telemetry redaction option applied consistently to connect start/stop/exception, message sent/received, and close start/stop. The actual transport URI must remain private to the connection process; telemetry should expose only explicitly allowlisted fields (for this caller: scheme, loopback host, and port).

Severity: needed

Related: #12