Add db.statement sanitization/masking examples

[mateuszrzeszutek]

What are you trying to achieve?

The trace DB spec mentions that the db.statement attribute value may be sanitized to exclude sensitive information but provides no example of such sanitization.
The aim of this issue is to add several examples of how we should sanitize database statements, e.g. INSERT INTO payment_cards (CC, EXP_DATE) values (?, ?) for SQL or HMSET cards cc ? exp_date ? for Redis.

Additional context.

See: open-telemetry/opentelemetry-java-instrumentation#1405

[Oberon00]

The given examples (if they actually contain ? instead of the actual values) need no sanitization I think.

[mateuszrzeszutek]

Yeah, those are after sanitization. Let me correct myself, I meant something like that:

raw db.statement	sanitized db.statement
INSERT INTO payment_cards (CC, EXP_DATE) values (1234432112344321, '10/2025')	INSERT INTO payment_cards (CC, EXP_DATE) values (?, ?)
HMSET cards cc 1234432112344321 exp_date '10/2025'?	HMSET cards cc ? exp_date ?

[avzis]

@mateuszrzeszutek
I think that in order to add specific examples, the specs should also better describe the format of the sanitization.
Like, what data need sanitization?
How to display sanitized data?
etc

(maybe it requires a dedicated issue)

[trask]

Rolling this issue into #717