feat(graphql): [Data Collection 4] Apply GraphQL policies

[adinauer]

PR Stack (Data Collection)

• feat(core): Data Collection #5759
• feat(core): [Data Collection 1] Add configuration types #5760
• feat(core): [Data Collection 2] Expose SentryOptions API #5761
• feat(core): [Data Collection 3] Add policy resolver #5799
• feat(graphql): [Data Collection 4] Apply GraphQL policies #5800
• feat(database): [Data Collection 5] Apply query policy #5801
• feat(spring): [Data Collection 6] Apply incoming request body policy #5802
• feat(apollo): [Data Collection 7] Apply incoming response body policy #5803
• feat(apollo): [Data Collection 8] Apply outgoing request body policy #5804
• feat(graphql): [Data Collection 9] Apply outgoing response body policy #5805
• feat(http): [Data Collection 10] Apply request header policy #5806
• feat(http): [Data Collection 11] Apply response header policy #5807
• feat(http): [Data Collection 12] Apply query parameter policy #5810
• feat(http): [Data Collection 13] Apply cookie collection policy #5811
• feat(user): [Data Collection 14] Apply user information policy #5812
• fix(android): [Data Collection 15] Scope device info cache to SDK options #5831
• feat(replay): [Data Collection 16] Inherit network collection policy #5832
• fix(android): [Data Collection 17] Apply user info policy to distinct ID #5833
• fix(spring): [Data Collection 18] Bind key-value policies #5834

---

📜 Description

Apply Data Collection policies to GraphQL document and variable capture across GraphQL Java and Apollo 2, 3, and 4 integrations.

The integrations independently filter GraphQL documents and variables while retaining operation metadata. Legacy sendDefaultPii, request-size, and integration-specific always-collect behavior remain unchanged when Data Collection is absent.

💡 Motivation and Context

GraphQL documents and variables can contain customer data. The new namespace provides granular control without forcing integrations to interpret legacy options themselves.

Refs #5666

💚 How did you test it?

• ./gradlew spotlessApply apiDump
• GraphQL core and Apollo 2/3/4 module tests
• ./gradlew apiCheck

📝 Checklist

• I added GH Issue ID & Linear ID
• I added tests to verify the changes.
• No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
• I updated the docs if needed.
• I updated the wizard if needed.
• Review from the native team if needed.
• No breaking change or entry added to the changelog.
• No breaking change for hybrid SDKs or communicated to hybrid SDKs.

🔮 Next steps

Apply the remaining Data Collection categories to database and HTTP integration paths.

#skip-changelog

⚠️ Merge this PR using a merge commit (not squash). Only the collection branch is squash-merged into main.

[github-actions]

	Messages
📖	Do not forget to update Sentry-docs with your feature once the pull request gets approved.

Generated by 🚫 dangerJS against 9f37039

[sentry]

📲 Install Builds

Android

🔗 App Name	App ID	Version	Configuration
SDK Size	io.sentry.tests.size	8.48.0 (1)	release

⚙️ sentry-android Build Distribution Settings

[lbloder]

GraphQL/Apollo also allow Http.Get for queries (https://graphql.org/learn/serving-over-http/#get-request-and-parameters) so we might need to filter that too, not just the request body.

[lbloder]

AFAIK we should also support lists to handle batched requests.

[github-actions]

Semver Impact of This PR

🟡 Minor (new features)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

---

This PR will not appear in the changelog.

---

_{🤖 This preview updates automatically when you update the PR.}