Distributed traces for hello commands leak passwords. If there are other redis commands that include password they likely leak there too.

I realize there is an option to disable the statement but that makes the traces less useful and there should be a finite amount of commands that can accept passwords.

Expected Behavior

Passwords are obfuscated or not included.

Current Behavior

Passwords are leaked in the db.statement attribute.

{
  "value": "hello 3 auth default <redacted>",
  "key": "db.statement"
}

Possible Solution

1. Introspect command and remove password
2. Allow folks to configure filters for commands

Steps to Reproduce