DataCollection phase 4: spec defaults for explicit DataCollection users

[jamescrosswell]

Part of #5420. Phase 4 — defaults flip (minor release).

Confirm/enable the spec defaults for users who explicitly set DataCollection:

• UserInfo = true, HttpBodies = All (four directions), denyList behaviors for cookies/headers/query params, FrameContextLines = 5.
• MaxRequestBodySize continues to govern body size (integration precedence).
• Behavior-neutral for everyone who has not set DataCollection (they stay on the SendDefaultPii bridge).
• Changelog callout documenting that DataCollection = new() is more permissive than SendDefaultPii = false, with the opt-out block.

JS references: getsentry/sentry-javascript#21348, #21352 (10.57.0 defaults flip gated on explicit opt-in).

[linear-code]

NET-773