Add open-telemetry/sdk and open-telemetry/exporter-otlp as dev dependencies

Problem/Motivation

Spin-off from #3346765: Add PerformanceTestBase for allowing browser performance assertions within FunctionalJavaScriptTests which is itself a spin-off from #638078: Automated performance testing for core.

Open telemetry is a collection of libraries/projects to support performance instrumentation in a variety of languages.

https://opentelemetry.io/

It has a PHP implementation: https://opentelemetry.io/docs/instrumentation/php/

The rationale for using OpenTelemetry is at #638078: Automated performance testing for core.

1. OpenTelemetry Dependency Evaluation

   Maintainership of the package

   The project appears well-maintained and has multiple official maintainers as well as active contributors, details at https://github.com/open-telemetry/opentelemetry-php/blob/main/CONTRIBUTI...

   It's part of the broader OpenTelemetry project, although I'm not clear how that works organisationally.

   OpenTelemetry itself is under the umbrella of the Cloud Native Computing Foundation https://www.cncf.io/

   Security policies of the package

   Prefer e-mail, github issue as a last resort, documented here: https://github.com/open-telemetry/opentelemetry-php/security/policy

   Expected release and support cycles

   Approaching a 1.0.0 release (currently beta), the 0.x series had tagged releases approximately once per month. Uses semver for release numbering.

   Code quality

   Modern PHP, strict types, decent online and in-code documentation.

   Other dependencies it would add, if any (the full tree, not just direct dependencies), and evaluations for those dependencies as well

   OpenTelemetry PHP also brings in:

   php-http/plug

   This in turn brings in:

   php-http/guzzle-adapter
   php-http/discovery
   php-http/promise
   All under https://github.com/php-http

   php-http/discovery runs a composer plugin to discover PSR-18 implementations.

2. Dependency evaluation for php-http/plug

   Maintainership

   Four active maintainers from different organisations: https://github.com/orgs/php-http/people

   Security policy

   https://docs.php-http.org/en/latest/development/contributing.html - issues reported privately via e-mail.

   Releases

   Appear to be approximately once per year, only minor version releases since 2018, semver.

   Code quality

   Modern PHP, semver, well documented. Not very much code between these three, it's all glue so that projects can require an http client without specifying which one.

3. Dependency evaluation for google/protobuf

   Maintainership

   Maintained by google.

   https://github.com/protocolbuffers/protobuf-php
   this is a subtree split from the main multi-language repository:
   https://github.com/protocolbuffers/protobuf/

   Release cycle

   Approximately quarterly releases. The previous minor release is maintained for at least a year after a new major release. https://protobuf.dev/support/version-support/

   Security support

   Contributions require a CLA
   Security policy (google's private reporting process): https://github.com/protocolbuffers/protobuf/security

   Code quality

   Modern PHP, well documented.

Proposed resolution

Add opentelemetry as a development dependency.

Note that OpenTelemetry requires a telemetry collector to receive traces, however the current implementation of #3346765: Add PerformanceTestBase for allowing browser performance assertions within FunctionalJavaScriptTests skips this logic if no endpoint is defined.

Tag1 is working with the Drupal Association to provide an endpoint, however it would be useful to have the dependency in core while that's being worked on, and it's not a hard dependency for the new performance tests which run and do their own assertions without it.

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet