feat(traces): before_span_send hook

Adds the traces `before_span_send` option: a callable, or a list run in order,
that receives each finished span as a plain dict (like the events before_send
hook) and returns it edited, or None to drop it. It is the documented place to
scrub sensitive values, so a hook that raises drops the span rather than
exporting it unscrubbed. trace_id, span_id and parent_span_id are read-only;
names, times, status and events are re-sanitized and the per-span limits
re-applied to whatever the hook returns. The hook runs with no tracing lock
held, and entries that are not callable are ignored with a warning. Not
reachable from the client.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TkZAsCciW4PV8ZdcCHmAbA

Author: turnipdabeets

posthog/test/tracing/test_config.py

@@ -221,3 +221,52 @@ def test_an_unusable_value_falls_back_rather_than_dropping_every_span(self, valu
         assert resolved.max_attributes_per_span == DEFAULT_MAX_ATTRIBUTES_PER_SPAN
         assert resolved.max_events_per_span == DEFAULT_MAX_EVENTS_PER_SPAN
         assert resolved.max_attribute_value_length == DEFAULT_MAX_ATTRIBUTE_VALUE_LENGTH
+
+
+class TestBeforeSpanSendConfig:
+    def test_accepts_one_hook_or_a_list(self):
+        def hook(span):
+            return span
+
+        assert resolve_traces_config({"before_span_send": hook}).before_span_send == (
+            hook,
+        )
+        assert resolve_traces_config(
+            {"before_span_send": [hook, hook]}
+        ).before_span_send == (hook, hook)
+
+    def test_defaults_to_no_hooks(self):
+        assert resolve_traces_config({}).before_span_send == ()
+
+    def test_skips_falsy_entries_silently(self, caplog):
+        caplog.set_level("WARNING", logger="posthog")
+
+        def hook(span):
+            return span
+
+        resolved = resolve_traces_config({"before_span_send": [None, False, hook]})
+        assert resolved.before_span_send == (hook,)
+        assert not caplog.records
+
+    def test_ignores_and_warns_about_entries_that_are_not_callable(self, caplog):
+        caplog.set_level("WARNING", logger="posthog")
+
+        def hook(span):
+            return span
+
+        resolved = resolve_traces_config({"before_span_send": ["scrub", hook]})
+        assert resolved.before_span_send == (hook,)
+        assert any("1 of 2" in r.getMessage() for r in caplog.records)
+
+    def test_a_hook_whose_truthiness_raises_is_still_resolved(self):
+        class Hook:
+            def __bool__(self):
+                raise RuntimeError("no")
+
+            def __call__(self, span):
+                return span
+
+        hook = Hook()
+        assert resolve_traces_config({"before_span_send": hook}).before_span_send == (
+            hook,
+        )