ref(replays): Restrict data scrubbing to sentry payloads

[jan-auer]

Unconditional data scrubbing can can break recording payloads because it scrubs strings that should be excluded from scrubbing. Eventually, the data scrubber will have to recurse through rrweb's DOM nodes and skip safe sub-trees or fields from scrubbing.

However, the client's default is to redact all strings from the DOM, which greatly reduces the chance of sensitive data ending up in the recording payloads. This leaves just Sentry's own payloads to be scrubbed, which are always top-level events marked with type: 5.

This PR updates the scrubber and introduces a visitor that streams through the top-level event list. When it encounters an item with type 5, it uses the existing transforming deserializer to scrub all strings in the event, otherwise skipping it. This solution allows us to continue scrubbing without a strict schema.

Alternatives

During implementation, there were two main alternatives considered:

1. Implement a struct for the top-level events that contains the type, timestamp, and opaque data. Inspect the type, conditionally map it to another struct that wraps data in ScrubbedValue, and then serialize that struct.
2. (implemented) Deserialize the top-level events into RawValue, parse it once with a helper struct to obtain the type. If the type matches, send the entire value through the transformer.

The second approach ultimately ended up in less code with equal to better performance, even though it requires to parse the raw value twice.

Safety

The raw_value feature in the serde_json deserializer is now enabled for all of Relay, since it is not possible to load the same crate another time with a separate set of features. There are no documented caveats on the raw_value feature in serde_json. The implementation uses a special token ("$serde_json::private::RawValue") in a way that makes it is safe for both serialize and deserialize:

• Serialization: Goes through serialize_struct with the token as name. Triggering this behavior requires a manual implementation of Serialize using this token, which our code does not contain.
• Deserialization: Goes through deserialize_newtype_struct with the token as name. Again, this requires a manual implementation of Deserialize to trigger accidentally.

Closes #1806

[olksdr]

[jan-auer]

Blocked by CI on:

• test(relay): Remove assertion on metrics allow list sentry#44287
• test(metrics): Fix transaction tag in extraction test sentry#44289