ref(core)!: Rename deprecated http.* span attributes

Part of the v11 migration away from attributes `@sentry/conventions` marks
deprecated. This PR covers the renames on HTTP spans, all of them 1:1 with no
behavior change. `http.target` and the Node body size behavior change follow in
stacked PRs; the `net.*` attributes are migrated separately in #23301.

`http.method` -> `http.request.method`, `http.status_code` ->
`http.response.status_code`, `http.status_text` -> `http.response.status_text`,
`http.scheme` -> `url.scheme`, `http.user_agent` -> `user_agent.original`,
`http.request_content_length` -> `http.request.body.size`,
`http.request_content_length_uncompressed` -> `http.request.body.decoded_size`,
`http.response_content_length` -> `http.response.body.size`,
`http.response_content_length_uncompressed` and
`http.decoded_response_content_length` -> `http.response.body.decoded_size`,
`http.response_transfer_size` -> `http.response.size`, and `url.same_origin` ->
`http.request.same_origin`.

The last two legacy response body size names meant the same thing — the decoded
response body size. Node HTTP spans used `http.response_content_length_uncompressed`,
browser resource spans used `http.decoded_response_content_length`.

Which of the encoded and decoded attribute an HTTP span sets is unchanged here:
the code still branches on whether a `content-encoding` header is present. That
branching is what the stacked body size PR addresses.

`http.host`, `http.flavor` and `http.client_ip` are dropped without a
replacement being set here. Their replacements — `server.address`,
`network.protocol.version` and `client.address` — are introduced by #23301, so
setting them here too would mean two PRs writing the same keys with different
values.

`SanitizedRequestData`, the shape backing `http` breadcrumb data, now keys the
method as `http.request.method`.

Span attributes in the touched files are now imported from
`@sentry/conventions/attributes` rather than written as string literals. That is
what surfaced `url.same_origin` as deprecated; as a literal it was invisible.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: msonnb

packages/core/src/integrations/http/server-subscription.ts

@@ -293,8 +293,8 @@ function buildServerSpanWrap(
       const name = `${method} ${httpTargetWithoutQueryFragment}`;
       const headers = request.headers;
       const userAgent = headers['user-agent'];
-      const ips = headers['x-forwarded-for'];
       const httpVersion = request.httpVersion;
+      const ips = headers['x-forwarded-for'];
       const host = headers.host as undefined | string;
       const hostname = host?.replace(/^(.*)(:[0-9]{1,5})/, '$1') || 'localhost';
       const scheme = fullUrl.startsWith('https') ? 'https' : 'http';