fix(core): Avoid sharing Data Collection fallbacks

Create key-value fallback behaviors for each resolver lookup so mutations cannot leak across cookie, query parameter, and header policies.

Refs #5666

Co-Authored-By: Claude <noreply@anthropic.com>

Author: adinauer

sentry/src/main/java/io/sentry/DataCollectionResolver.java

@@ -9,10 +9,6 @@
 @ApiStatus.Internal
 public final class DataCollectionResolver {
 
-  private static final @NotNull KeyValueCollectionBehavior OFF = KeyValueCollectionBehavior.off();
-  private static final @NotNull KeyValueCollectionBehavior EMPTY_DENY_LIST =
-      KeyValueCollectionBehavior.denyList();
-
   private final @NotNull SentryOptions options;
 
   DataCollectionResolver(final @NotNull SentryOptions options) {
@@ -71,9 +67,11 @@ public boolean isGraphqlVariablesWithLegacyAlways() {
       return cookies;
     }
     if (isDataCollectionConfigured()) {
-      return EMPTY_DENY_LIST;
+      return KeyValueCollectionBehavior.denyList();
     }
-    return options.isSendDefaultPii() ? EMPTY_DENY_LIST : OFF;
+    return options.isSendDefaultPii()
+        ? KeyValueCollectionBehavior.denyList()
+        : KeyValueCollectionBehavior.off();
   }
 
   public @NotNull KeyValueCollectionBehavior getUrlQueryParams() {
@@ -128,7 +126,7 @@ private boolean explicitOrDefault(
 
   private @NotNull KeyValueCollectionBehavior explicitOrEmptyDenyList(
       final @Nullable KeyValueCollectionBehavior explicit) {
-    return explicit != null ? explicit : EMPTY_DENY_LIST;
+    return explicit != null ? explicit : KeyValueCollectionBehavior.denyList();
   }
 
   private boolean isHttpBodyEnabled(

sentry/src/test/java/io/sentry/DataCollectionResolverTest.kt

@@ -244,6 +244,17 @@ class DataCollectionResolverTest {
     assertThat(options.dataCollectionResolver.cookies).isEqualTo(KeyValueCollectionBehavior.off())
   }
 
+  @Test
+  fun `mutating one fallback key-value behavior does not affect other getters`() {
+    val resolver = SentryOptions().apply { dataCollection.setUserInfo(true) }.dataCollectionResolver
+
+    resolver.cookies.terms = listOf("custom-cookie")
+
+    assertThat(resolver.urlQueryParams.terms).doesNotContain("custom-cookie")
+    assertThat(resolver.httpRequestHeaders.terms).doesNotContain("custom-cookie")
+    assertThat(resolver.httpResponseHeaders.terms).doesNotContain("custom-cookie")
+  }
+
   @Test
   fun `cookies use default deny list when unset and sendDefaultPii is true`() {
     val options = SentryOptions().apply { isSendDefaultPii = true }