Part of #5420. Phase 0 — hardening pre-work, no new public API.

Today only Authorization and Proxy-Authorization header values are redacted (src/Sentry/Internal/RedactedHeaders.cs, SentryRequest.AddHeaders, Protocol/Response.AddHeaders), and only in some paths. Apply the full sensitive-terms denylist filter to header values unconditionally — regardless of SendDefaultPii — in:

• src/Sentry/SentryRequest.cs / src/Sentry/Protocol/Response.cs (AddHeaders)
• src/Sentry.AspNetCore/ScopeExtensions.cs (request header capture)
• src/Sentry.AspNet/Internal/SystemWebRequestEventProcessor.cs
• src/Sentry/SentryHttpFailedRequestHandler.cs / SentryGraphQLHttpFailedRequestHandler.cs

Key names are kept; values become [Filtered]. Depends on the denylist/filter utility issue.

JS reference: getsentry/sentry-javascript#18311 (shipped standalone in 10.27.0, well before the option existed).