feat(coderd/tracing): correlate request logs and spans by client_session_id - #27671

…ge key

Reference the exported SessionIDBaggageKey constant when reading the baggage
member and when constructing baggage headers in tests, instead of repeating
the string literal. The emitted slog field and span attribute names remain
snake_case string literals ("session_id"), as required by the slog field-name
lint rule.

The connection-log RFC was updated to mandate lowercase hexadecimal for
session IDs so that case-sensitive searches correlate reliably. Tighten
validSessionID to reject uppercase and update the tests accordingly.

Add a test asserting the baggage key, log field name, and span attribute
name all equal "session_id". slog field names must be snake_case string
literals, so the log field and span attribute cannot reference the
SessionIDBaggageKey const directly; this test guards against them drifting
apart and silently breaking log/trace correlation (PR review P2).

…utes

The middleware extracts session_id only on matched API/app routes. Add a
subtest that sends well-formed baggage to a non-matching path (/index.html)
and asserts session_id is absent from both the log fields and the span, so a
regression that logged client-controlled baggage on every request would be
caught (PR review P3).

The negative span assertions checked only that a specific value was not set,
so a bug setting session_id to a different derived value would pass. Scan the
span attributes for any key equal to session_id and assert its absence in the
malformed-baggage and non-matching-route cases (PR review P3).

Use hex.DecodeString to check the value is 16 bytes of hex, matching the
codebase convention, then require hex.EncodeToString(b) == s so only the
canonical lowercase encoding is accepted (hex.DecodeString also accepts
upper-case) (PR review nit).

Fold recordingTracer into fakeTracer via an optional recording span, and
add a tracing-enabled + no-baggage subtest that pins the branch which must
not set an empty session_id span attribute or log field.

The tracer provider is never nil in production (coderd defaults it to a
no-op provider when tracing is disabled), so drop the tracer == nil
special case. Default a nil provider to no-op and always start the span
and set the client_session_id attribute; the no-op tracer discards the
span. Addresses review feedback on #27671.

…tracing-middleware

# Conflicts:
#	coderd/tracing/httpmw_test.go

Extract a sessionIDFromQueryString helper that mirrors
sessionIDFromHeaders: extract the client_session_id from its source,
validate it, and return an empty string when absent or malformed.
sessionIDFromRequest now composes the two extractors, keeping baggage
precedence. Each extractor stays self-validating so sessionIDFromHeaders
keeps its validated contract, which the agent SessionIDMiddleware relies
on. Adds a symmetric TestSessionIDFromQueryString internal test.