feat(tracer)!: default span names to operation name for OTel compliance

[obitech]

Summary

Span names now default to the low-cardinality operation name (e.g. SELECT) instead of the raw SQL statement, following the OpenTelemetry database span conventions. The full statement remains available in the db.query.text attribute.

Closes #68.

Motivation

The previous default embedded the raw SQL in the span name, prefixed with query/prepare/batch query. Because redaction and masking rules are typically applied to attributes (like db.query.text) rather than to span names, sensitive data inside a statement could leak into telemetry through the name — the security incident reported in #68. The OTel conventions also require span names to be low cardinality, which the raw statement violates.

What changed

• tracer.go: span name is now built from the operation name by default; the operation name is computed once per query and shared between the db.operation.name attribute and the span name (a new spanName helper, replacing three duplicated inline blocks).
• options.go:
  • Added WithFullSQLInSpanName() — opt back into the full SQL statement as the span name (discouraged; can leak data).
  • Added WithQuerySpanNamePrefix() — opt back into the query/prepare/batch query prefix.
  • Deprecated WithTrimSQLInSpanName() and WithDisableQuerySpanNamePrefix() — their effects are now the defaults.
• tracer_test.go: added TestTracer_spanName asserting span names directly across query/prepare/batch and all option combinations (previously only attributes were asserted).

Breaking change

The default span name changes from the full SQL statement to the operation name, and the query/prepare/batch query prefix is no longer added by default. To restore the previous behavior exactly:

otelpgx.NewTracer(
    otelpgx.WithFullSQLInSpanName(),
    otelpgx.WithQuerySpanNamePrefix(),
)