[net/http] add http.server.active_requests metric

[hadrienk]

Follow up of #2617. As @Aneurysm9 pointed out the Labeler can only be used after the next handler has been called. This means that for active requests it is impossible to inject attributes this way.

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: hadrienk / name: Hadrien Kohl (ed6af23, 5783243, 7fa5d03, 2d78bd2, 4be1478, ccb9127, 0262b91)
• ✅ login: hanyuancheung / name: Chester Cheung (42dc8bc)

[hadrienk]

I suppose we could add a comment somewhere about the fact that only metrics recorded after the handler is called are modifiable using a Labeler.

[harsh-vipps]

➕

[pellared]

Can you please

1. Cover the new metric in tests.
2. Add a changelog entry.

[pellared]

Please resolve the conflicts. Otherwise I cannot even run the GitHub workflows.

[hadrienk]

Tried hard to add the route tag to the active_request but since it has to be started before the tag is injected using the Labeler there's way to fix that without changing the API a lot.

[codecov]

Codecov Report

Merging #4543 (42dc8bc) into main (5ba7d1e) will increase coverage by 0.0%.
Report is 1 commits behind head on main.
The diff coverage is 66.6%.

Additional details and impacted files

@@          Coverage Diff          @@
##            main   #4543   +/-   ##
=====================================
  Coverage   80.8%   80.8%           
=====================================
  Files        150     150           
  Lines      10371   10361   -10     
=====================================
- Hits        8387    8380    -7     
+ Misses      1840    1835    -5     
- Partials     144     146    +2     

Files	Coverage Δ
instrumentation/net/http/otelhttp/common.go	100.0% <ø> (ø)
instrumentation/net/http/otelhttp/handler.go	87.4% <84.2%> (-0.4%)	⬇️
...ion/google.golang.org/grpc/otelgrpc/interceptor.go	88.5% <47.0%> (+0.6%)	⬆️

[hadrienk]

Anything else you need me to do on this PR?

[pellared]

1. There is a vulnerability in the code
2. The build fails

[pellared]

This line would bring back the vulnerability caused by unbound cardinality metric attribute (HTTP method) GHSA-rcjv-mgp8-qvmr

[pellared]

Tried hard to add the route tag to the active_request but since it has to be started before the tag is injected using the Labeler there's way to fix that without changing the API a lot.

It is OK to not add it.

Take notice that this attribute is not specified in v1.20.0 (https://github.com/open-telemetry/opentelemetry-specification/blob/v1.20.0/specification/metrics/semantic_conventions/http-metrics.md) nor in the latest (https://opentelemetry.io/docs/specs/semconv/http/http-metrics/#metric-httpserveractive_requests)