Fix SCI calculation in example dashboards and exclude high-cardinality attributes from resource demand metrics - #390

This MR fixes two problems found in a user's bug report: SCI values that were far too high, and transactions that showed a rate of 0.

1. Fix the SCI formula in the example Grafana dashboards

The SCI panels in all four example dashboards had unit errors. The corrected formulas follow the model from our SSP24 and FSE'25 papers. Recomputed with the
measurement data from the FSE'25 paper (Table 4), the new formula matches the published per-transaction power values within 0.6–1.5 %.

• CPU utilization: rate() returns ms per second, but the old formula treated it as ms per minute (/ 60000) and didn't divide by the vCPU count. It now uses rate
  / 1000 / vCPU.
• CPU power: min/max power are published per vCPU, so they are now multiplied by the vCPU count.
• CPU energy: the old formula produced Joules instead of kWh, which made it too high by a factor of 3600. It is now PTcpu / 60 / 1000, i.e. kWh per minute.
• Attribution: the Spring and Quarkus dashboards didn't assign CPU power to the transaction, so it is now multiplied by CPUutilT. PUE is now applied as well.
• Unit mismatches: GEF is published in kg/kWh, so the CPU and memory terms are now converted to g. Embodied emissions were in mg and are now converted to g. The memory rate is now converted from per-second to per-minute.
• New gauge io.retit.emissions.instance.vcpu.count: gives the dashboards the vCPU count, which was previously only available as a label.
• README: documents the units of all metrics, including the process CPU time in ms and the Prometheus naming difference between the two CPU counters, plus the full SCI formula.

2. Exclude high-cardinality span attributes from resource demand metrics

All span attributes were copied onto the io.retit.resource.demand.* counters, including url.query. If the query contains session or person IDs, almost every
request creates its own time series. A new series starts with a single value, so Prometheus' rate() returns 0 for it, and after 2000 series the SDK puts
everything into an overflow series that has no url.path. Personal data also ended up as metric labels.

• Extended default exclusion list: besides the existing network, thread, user, client and instance, it now also excludes:
  • url.query, url.full, url.fragment
  • http.request.header, http.response.header
  • session, enduser
  • messaging.message.id, messaging.message.conversation_id
  • db.statement, db.query.text
• New config option IO_RETIT_METRICS_EXCLUDED_ATTRIBUTES: a comma-separated list of prefixes that replaces the default list. For example, it can bring url.query
  back for applications that dispatch via query parameters. io.retit.* attributes are always excluded.
• Unit tests in MetricPublishingServiceTest cover the default list, a replacement list and an empty list.
• README: documents the new option and which attributes are published by default.

Breaking changes

• Metric attributes from the newly excluded prefixes are no longer published. Queries that filter or group by url_query etc. need to be adjusted.
• The example dashboards need the new vCPU gauge, so they require this extension version.