Capture all repeated `Cookie` and `Set-Cookie` header values

先檢查 OkHttp、Ktor、Apollo 3 和 Apollo 4 整合中現有的 cookie 擷取與 header 存取路徑，然後比較其他 SDK 如何處理重複的 header。在執行整合測試之前，追蹤共用的 cookie 原則以及缺少 Data-Collection 時的行為。完成的標準是：涵蓋重複的 Cookie 和 Set-Cookie 值，且不進行不安全的逗號處理；篩選仍然有效；格式錯誤的值 fail closed。

Problem

The OkHttp, Ktor, and Apollo integrations capture only one Cookie or Set-Cookie header value when creating request and response contexts. Their current header accessors select a single value, so additional cookie fields are omitted from Sentry telemetry.

This is valid HTTP behavior. In particular, HTTP/2 allows clients to split the Cookie field into multiple header fields for compression. Responses also commonly contain multiple Set-Cookie fields.

This is follow-up completeness work from #5811 and supports #5666.

Check what other SDKs are doing before implementing.

Proposed solution

Make cookie extraction list-aware across OkHttp, Ktor, Apollo 3, and Apollo 4:

• Combine repeated request Cookie fields with ; before applying the effective cookie policy.
• Process each response Set-Cookie field independently because each field represents one cookie and its attributes.
• Do not comma-join or comma-split Set-Cookie values. A valid Expires attribute contains a comma.
• Add shared core helpers or integration-specific adapters that apply the effective cookie policy to every value.
• Preserve valid Set-Cookie attributes and fail closed for malformed input.

Preserve the existing absent-Data-Collection compatibility behavior for each integration.

Acceptance criteria

• OkHttp, Ktor, Apollo 3, and Apollo 4 capture all repeated cookie header values supported by their header APIs.
• Multiple request Cookie fields are combined with ; and filtered as one cookie string.
• Multiple response Set-Cookie fields are filtered independently without comma splitting or joining.
• Built-in sensitive-cookie filtering and configured allow-list, deny-list, and off behavior apply to every cookie value.
• Malformed cookie values never bypass filtering.
• Integration tests cover at least two request Cookie fields and two response Set-Cookie fields where the underlying header API supports repeated values.