enduser.id should not be captured by default

[philsttr]

Describe the bug

The General Identity Attributes convention for enduser.* attributes states:

Given the sensitive nature of this information, SDKs and exporters SHOULD drop these attributes by default and then provide a configuration parameter to turn on retention for use cases where the information is required and would not violate any policies or regulations.

However, the existing servlet instrumentation currently captures the enduser.id attribute in a couple places (here and here) by default, without requiring the user to explicitly enable those attributes.

Steps to reproduce

1. Execute an authenticated request against a servlet based application.
2. Observe enduser.id attribute captured by default.

Expected behavior

I expect the enduser.id attribute to not be captured by default.
I expect that I am required to explicitly enable capturing of the enduser.id attribute.

Actual behavior

enduser.id attribute captured by default without requiring the user to explicitly enable it.

Javaagent or library instrumentation version

1.31.0

Environment

No response

Additional context

No response