[Bug]: W3C Baggage propagation compliance issues #3784

What happened?

The current W3C Baggage propagation logic in the opentelemetry_sdk crate has several issues and needs to be reworked. More specifically:

• Extraction currently percent-decodes properties, whereas injection appends decoded metadata directly. This makes the baggage propagator susceptible to injection attacks when Baggage is propagated. (e.g. a=1;b=2%2Cc%3D3 => a=1;b=2,c=3)
• W3C Baggage allows equals signs in values, the current parser doesn't handle this correctly.
• Fragment encoding set omits some characters which require encoding according to W3C (e.g. '%' and '')
• Propagator does not respect repeated baggage headers.
• Invalid UTF-8 sequences are dropped instead of replaced (according to W3C spec)
• Size tracking in the API baggage doesn't release size budget for remove() calls
• Warning logs display full header value. We generally shouldn't do this since Baggage can be sensitive.

OpenTelemetry API Version (i.e version of opentelemetry crate)

0.33.1

OpenTelemetry SDK Version (i.e version of opentelemetry_sdk crate)

0.33.1

What Exporter(s) are you seeing the problem on?

No response

Relevant log output

N/A

Tip

_{React with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding +1 or me too, to help us triage it. Learn more here.}