Fixes #108

Most HTTP server instrumentations report server.address and server.port based on the request Host header as it's the only source of information they have.

Depending on the reverse proxies presence and other infra configuration, Host header might come unmodified from clients. Malicious or buggy clients could cause a cardinality explosion and degrade the server metrics experience.

The expectation is that the majority of HTTP applications do not need server.address and server.port attributes on metrics as these attributes are static and are the same for a specific service.name or a combination of resource attributes.

They are beneficial in multi-host applications, but still, resource attributes set on the corresponding meter and tracer providers can be used to distinguish tenants.

This PR changes

• server.* requirement level to:
  • opt_in for metrics, to mitigate the attack vector
  • recommended for traces. These attributes are still interesting, but not essential for the tracing experience.
    url.query requirement level changed from recommended to required (to match url.path) on spans - this seems like a bug that slipped into BREAKING: Introduce common url.* attributes, and improve use of namespacing under http.* opentelemetry-specification#3355