Merge the audit fixes from the branches below, and port them to the Boot 2 agent

Ports the tracing and GraphQL checks to the Boot 2 agent suite, and
gives the app three minutes to start, as for Boot 3 and 4.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: runningcode

sentry-spring-boot/src/integrationTestOtelAgent/kotlin/io/sentry/spring/boot/otelagentintegrationtest/AgentApp.kt

@@ -40,8 +40,11 @@ class AgentApp(args: List<String> = emptyList()) : Closeable {
       args = listOf("--server.port=0") + args,
     )
 
+  // The agent instruments classes as they load, which on a busy CI runner has taken over a minute.
   val restTemplate =
-    TestRestTemplate(RestTemplateBuilder().rootUri("http://localhost:${app.awaitPort()}"))
+    TestRestTemplate(
+      RestTemplateBuilder().rootUri("http://localhost:${app.awaitPort(timeoutSeconds = 180)}")
+    )
 
   override fun close() {
     app.close()

sentry-spring-boot/src/integrationTestOtelAgent/kotlin/io/sentry/spring/boot/otelagentintegrationtest/DistributedTracingIntegrationTest.kt

@@ -4,6 +4,7 @@ import com.google.common.truth.Truth.assertThat
 import io.sentry.SentryEnvelope
 import io.sentry.protocol.SentryId
 import io.sentry.test.transaction
+import kotlin.random.Random
 import kotlin.test.Test
 import org.springframework.http.HttpEntity
 import org.springframework.http.HttpHeaders
@@ -27,27 +28,27 @@ class DistributedTracingIntegrationTest : IntegrationTest() {
       )
     assertThat(status).isEqualTo(500)
 
-    awaitTransaction("GET /tracing/{id}", traceId)
+    val incoming = awaitTransaction("GET /tracing/{id}", traceId).transaction()!!
+    assertThat(incoming.request?.url).endsWith("/tracing/1")
     awaitTransaction("GET /person/{id}", traceId)
   }
 
   @Test
   fun `unsampled trace sends no transactions`() {
     val traceId = SentryId()
+    // An id only this request uses, because a mishandled header could start a trace of its own.
+    val id = Random.nextLong(2, Long.MAX_VALUE)
     val status =
       get(
-        "/tracing/1",
+        "/tracing/$id",
         sentryTrace = "$traceId-424cffc8f94feeee-0",
         baggage =
           "sentry-public_key=502f25099c204a2fbf4cb16edc5975d1,sentry-sample_rand=0.456789,sentry-sample_rate=0.5,sentry-sampled=false,sentry-trace_id=$traceId,sentry-transaction=HTTP%20GET",
       )
     assertThat(status).isEqualTo(500)
 
     // Longer than the 5 seconds the app's spans can wait for their batch to be exported.
-    server.assertNoEnvelope(millis = 6_000) {
-      isTransaction(it, "GET /tracing/{id}", traceId) ||
-        isTransaction(it, "GET /person/{id}", traceId)
-    }
+    server.assertNoEnvelope(millis = 6_000) { isForRequest(it, id) }
   }
 
   @Test
@@ -64,6 +65,8 @@ class DistributedTracingIntegrationTest : IntegrationTest() {
 
     val incoming = awaitTransaction("GET /tracing/{id}", traceId).header.traceContext!!
     val outgoing = awaitTransaction("GET /person/{id}", traceId).header.traceContext!!
+    assertThat(incoming.traceId).isEqualTo(traceId)
+    assertThat(outgoing.traceId).isEqualTo(traceId)
     assertThat(incoming.sampleRand).isNotNull()
     assertThat(outgoing.sampleRand).isEqualTo(incoming.sampleRand)
   }
@@ -82,6 +85,8 @@ class DistributedTracingIntegrationTest : IntegrationTest() {
 
     val incoming = awaitTransaction("GET /tracing/{id}", traceId).header.traceContext!!
     val outgoing = awaitTransaction("GET /person/{id}", traceId).header.traceContext!!
+    assertThat(incoming.traceId).isEqualTo(traceId)
+    assertThat(outgoing.traceId).isEqualTo(traceId)
     assertThat(incoming.sampleRate).isNotEqualTo("0.5")
     assertThat(outgoing.sampleRate).isEqualTo(incoming.sampleRate)
   }
@@ -131,6 +136,12 @@ class DistributedTracingIntegrationTest : IntegrationTest() {
       isTransaction(it, name, traceId)
     }
 
+  /** Whether [envelope] is a transaction for `/tracing/[id]` or the `/person/[id]` it calls. */
+  private fun isForRequest(envelope: SentryEnvelope, id: Long): Boolean {
+    val url = envelope.transaction()?.request?.url ?: return false
+    return url.endsWith("/tracing/$id") || url.endsWith("/person/$id")
+  }
+
   private fun isTransaction(envelope: SentryEnvelope, name: String, traceId: SentryId): Boolean {
     val transaction = envelope.transaction() ?: return false
     return transaction.transaction == name && transaction.contexts.trace?.traceId == traceId

sentry-spring-boot/src/integrationTestOtelAgent/kotlin/io/sentry/spring/boot/otelagentintegrationtest/GraphqlIntegrationTest.kt

@@ -72,6 +72,8 @@ class GraphqlIntegrationTest : IntegrationTest() {
     val tasks = response["data"]["tasks"]
     assertThat(tasks.size()).isEqualTo(5)
     assertThat(tasks[0]["id"].asText()).isEqualTo("T1")
+    assertThat(tasks[0]["assigneeId"].asText()).isEqualTo("A3")
+    assertThat(tasks[0]["creatorId"].asText()).isEqualTo("C3")
     assertThat(tasks[0]["assignee"]["id"].asText()).isEqualTo("A3")
     assertThat(tasks[0]["creator"]["id"].asText()).isEqualTo("C3")