feat(request-trace-uploader): add NCA audit payload drop

[kristinapathak]

Why

Some audit request records must omit request and response payloads before S3 export for a configured list of NCA IDs. The feature must not remove correlation evidence or leak payloads in later records of the same request.

Scope

• Accept REQUEST_TRACE_UPLOADER_DROP_NCA_IDS as a comma-separated drop list. Normalize whitespace, duplicates, and equivalent nca-<id>-nca forms.
• Apply only to the audit capture type. Do not drop matching records or change the trace capture type.
• Read nvcf-ncaid then nvcf-nca-id headers case-insensitively. Support scalar and list-valued header forms.
• For a matching audit record, retain only safe correlation metadata, normalized NCA ID, and explicit drop marker. Remove request payload, response payload, and non-NCA headers.
• Carry the decision across later records sharing the request ID when they lack an NCA header.
• Apply the drop only to the upload transport data. Do not claim it removes raw payloads already written to the local spool.
• Never emit NCA IDs, request IDs, headers, or payload values as metric attributes, trace attributes, or logs.

Tests

• Normalization, duplicate, wrapped ID, empty, and case-sensitivity tests.
• Header alias, header casing, scalar, list, missing, and malformed-header tests.
• Matching request followed by a headerless response test.
• Exact safe-envelope and payload-redaction tests.

Parent: #1004