Bump OpenTelemetry dependencies to latest (0.219.0 / core 2.8.0)

[delthas]

What

Bump arsenal's OpenTelemetry dependencies to the latest published versions, in two commits:

1. Bump the OTEL suite — every @opentelemetry/* dep now resolves to a single latest version (no duplicates):
   • @opentelemetry/sdk-node, @opentelemetry/exporter-trace-otlp-http: ^0.218.0 → ^0.219.0
   • @opentelemetry/resources, @opentelemetry/sdk-trace-base, @opentelemetry/context-async-hooks, @opentelemetry/core: ^2.7.1 → ^2.8.0
   • @opentelemetry/api: ^1.9.0 → ^1.9.1 (also dedupes the lone api@1.9.0 that prom-client left in the lockfile)
2. Bump the package version 8.4.9 → 8.4.10

Why

The 0.218.0 OTEL suite transitively pins @opentelemetry/core@2.7.1, which carries GHSA-8988-4f7v-96qf (moderate — unbounded memory allocation in W3C Baggage propagation, patched in 2.8.0). sdk-node@0.219.0 pins core@2.8.0, so the vulnerable 2.7.1 is removed from the dependency tree entirely (no version skew).

This unblocks cloudserver's dependency-review CI, which fails on the transitive core@2.7.1 once arsenal is bumped (CLDSRV-928 / scality/cloudserver#6192).

Supersedes the partial dependabot bump (dependabot/npm_and_yarn/opentelemetry/core-2.8.0), which bumps only the direct core devDependency and leaves core@2.7.1 reachable through sdk-node@0.218.0.

Issue: ARSN-598

[bert-e]

Hello delthas,

My role is to assist you with the merge of this
pull request. Please type @bert-e help to get information
on this process, or consult the user documentation.

Available options

name	description	privileged	authored
/after_pull_request	Wait for the given pull request id to be merged before continuing with the current one.
/bypass_author_approval	Bypass the pull request author's approval	⭐
/bypass_build_status	Bypass the build and test status	⭐
/bypass_commit_size	Bypass the check on the size of the changeset TBA	⭐
/bypass_incompatible_branch	Bypass the check on the source branch prefix	⭐
/bypass_jira_check	Bypass the Jira issue check	⭐
/bypass_peer_approval	Bypass the pull request peers' approval	⭐
/bypass_leader_approval	Bypass the pull request leaders' approval	⭐
/approve	Instruct Bert-E that the author has approved the pull request.		✍️
/create_pull_requests	Allow the creation of integration pull requests.
/create_integration_branches	Allow the creation of integration branches.
/no_octopus	Prevent Wall-E from doing any octopus merge and use multiple consecutive merge instead
/unanimity	Change review acceptance criteria from one reviewer at least to all reviewers
/wait	Instruct Bert-E not to run until further notice.

Available commands

name	description	privileged
/help	Print Bert-E's manual in the pull request.
/status	Print Bert-E's current status in the pull request TBA
/clear	Remove all comments from Bert-E from the history TBA
/retry	Re-start a fresh build TBA
/build	Re-start a fresh build TBA
/force_reset	Delete integration branches & pull requests, and restart merge process from the beginning.
/reset	Try to remove integration branches unless there are commits on them which do not appear on the source branch.

Status report is not available.

[bert-e]

Waiting for approval

The following approvals are needed before I can proceed with the merge:

• the author

• 2 peers

[claude]

LGTM

Review by Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.30%. Comparing base (2366010) to head (d415b43).

Additional details and impacted files

@@                 Coverage Diff                 @@
##           development/8.4    #2649      +/-   ##
===================================================
+ Coverage            74.27%   74.30%   +0.02%     
===================================================
  Files                  229      229              
  Lines                18646    18646              
  Branches              3884     3884              
===================================================
+ Hits                 13849    13854       +5     
+ Misses                4792     4787       -5     
  Partials                 5        5              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[bert-e]

Waiting for approval

The following approvals are needed before I can proceed with the merge:

• the author

• 2 peers

[delthas]

/approve

[bert-e]

Request integration branches

Waiting for integration branch creation to be requested by the user.

To request integration branches, please comment on this pull request with the following command:

/create_integration_branches

Alternatively, the /approve and /create_pull_requests commands will automatically
create the integration branches.

[bert-e]

Integration data created

I have created the integration data for the additional destination branches.

• this pull request will merge improvement/ARSN-598/bump-opentelemetry-deps into
  development/8.4
• w/8.5/improvement/ARSN-598/bump-opentelemetry-deps will be merged into development/8.5

The following branches will NOT be impacted:

• development/6.4
• development/7.10
• development/7.4
• development/7.70
• development/8.1
• development/8.2
• development/8.3

You can set option create_pull_requests if you need me to create
integration pull requests in addition to integration branches, with:

@bert-e create_pull_requests

The following options are set: approve

[bert-e]

I have successfully merged the changeset of this pull request
into targetted development branches:

• ✔️ development/8.4

• ✔️ development/8.5

The following branches have NOT changed:

• development/6.4
• development/7.10
• development/7.4
• development/7.70
• development/8.1
• development/8.2
• development/8.3

This pull request did not target the following hotfix branch(es) so they
were left untouched:

• hotfix/7.9.0
• hotfix/7.10.4
• hotfix/7.10.46
• hotfix/7.70.14
• hotfix/7.10.57
• hotfix/7.70.4
• hotfix/7.8.0
• hotfix/7.70.20
• hotfix/7.10.29
• hotfix/6.4.7
• hotfix/7.4.7
• hotfix/7.4.4
• hotfix/7.2.0
• hotfix/7.10.1
• hotfix/7.4.2
• hotfix/7.10.36
• hotfix/7.4.5
• hotfix/7.4.1
• hotfix/7.10.31
• hotfix/7.4.0
• hotfix/7.70.25
• hotfix/7.4.8
• hotfix/7.6.0
• hotfix/7.7.0
• hotfix/7.5.0
• hotfix/7.10.47
• hotfix/7.4.9
• hotfix/7.10.3
• hotfix/7.10.43
• hotfix/7.10.2
• hotfix/7.4.3
• hotfix/7.4.10
• hotfix/7.10.0
• hotfix/7.4.6

Please check the status of the associated issue ARSN-598.

Goodbye delthas.

The following options are set: approve