fix(otel): prevent PII redaction from corrupting session/user IDs and validate card numbers with Luhn check

[sy0u1ti]

Fixes #195.

What does this PR do?

Fixes an issue where TraceConfig(pii_redaction=True) corrupted session IDs, user IDs, timestamps, and UUIDs.

Why?

1. The credit-card regex matched any 13-19 digit run with optional hyphens/spaces without Luhn checksum validation. As a result, random UUIDs with long digit segments, millisecond timestamps, and decimal numbers were erroneously replaced with <CREDIT_CARD>.
2. The phone number regex lacked negative lookbehind/lookahead for digits, causing substrings of longer numbers to be matched as <PHONE_NUMBER>.
3. TraceConfig.mask() applied PII redaction unconditionally to all span attribute values, mutating core correlation identifiers (session.id, user.id, gen_ai.conversation.id).

Changes

• Added ISO/IEC 7812 Luhn checksum verification (_luhn_check) so only valid credit card numbers are redacted.
• Added digit boundaries ((?<!\d) and (?!\d)) to _PHONE_RE to prevent matching parts of longer numbers or timestamps.
• Protected structured correlation attributes (SpanAttributes.SESSION_ID, SpanAttributes.USER_ID, SpanAttributes.GEN_AI_CONVERSATION_ID) from free-text PII masking in TraceConfig.mask().
• Added unit tests in python/tests/test_pii_redaction.py.

How was it tested?

• pytest tests/test_pii_redaction.py tests/test_config.py -q (25 passed)
• Verified that valid cards (Visa, etc.) are still redacted as <CREDIT_CARD>.
• Verified that UUIDs with numeric stretches and timestamps (1725700000000) remain intact.
• Verified that session.id and user.id pass through mask() unchanged.