fix: keep GenAI content out of the backend recipe, isolate SDK TLS, set content capture

[krisztianfekete]

Fixes three issues:

• Collector recipe: the production recipe sent message content to the backend (logs had no content processor, and ADK, OpenLLMetry and tool attributes were not removed). It now drops content events and deletes content keys on the backend branch. Tested on Collector contrib 0.162.0: 0 of 30 planted content values reach the backend (27 before), and the agentevals branch is unchanged.
• SDK TLS isolation: the SDK exporters still used the application's OTEL_EXPORTER_OTLP_* client certificate and CA bundle when sending to agentevals. Every request now uses default verification and no client certificate.
• Content capture default: the SDK set OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT=true, which util-genai rejects in gen_ai_latest_experimental mode, so no content was captured. It now sets SPAN_ONLY in that mode and true otherwise.