tracing: configure SDK explicitly instead of mutating process env

[satyamg1620]

What type of PR is this?
/kind bug

What this PR does / why we need it:

InitTracing applied its defaults by calling os.Setenv for OTEL_SERVICE_NAME and OTEL_EXPORTER_OTLP_ENDPOINT, relying on the SDK to read them back. Mutating the process environment affects any other code in the process that reads those variables, is not reentrant, and leaves tests interfering with each other — InitTracing had no test coverage at all as a result.

The resource is now built directly via resource.New. Detectors are applied in order and later ones win, so placing WithFromEnv last keeps OTEL_SERVICE_NAME and OTEL_RESOURCE_ATTRIBUTES overriding the built-in service name.

This also fixes trace attribution. The previous resource was built with resource.NewWithAttributes, which never consults the environment, so neither service.name nor the chart's OTEL_RESOURCE_ATTRIBUTES (k8s.namespace.name, k8s.node.name, k8s.pod.name) ever reached a span — the os.Setenv calls had no effect on the exported resource. Spans now carry them.

Three implementation notes:

• The plaintext loopback default is pinned, conditionally. The SDK defaults the gRPC endpoint to localhost:4317 but negotiates TLS for it, and tracing: honor OTLP TLS and auth environment variables #2312 removed the hardcoded WithInsecure. Simply dropping the old default therefore pointed the local development path at TLS against a plaintext collector. localCollectorOptions supplies the endpoint and the insecure transport only when the environment sets none of the endpoint, insecure or certificate variables; as soon as one is set the options are dropped, so an operator's configuration is never overridden.

• A partial resource no longer aborts startup. resource.New reports a malformed OTEL_RESOURCE_ATTRIBUTES entry alongside a resource holding everything it could parse. Returning that error made a single stray comma in a chart value fail InitTracing, which the EPP runner turns into a process exit. The error is logged and the degraded resource is used.

• resource.Default() is not merged in. It carries semconv v1.41.0 while this package uses v1.37.0, and merging conflicting schema URLs drops the schema URL from the result. Aligning the semconv version is a separate change; the reason is recorded in a comment so it is not re-added by accident.

Which issue(s) this PR fixes:

Fixes #2297

Part of #1632.

Test plan:

• service.name defaults to the caller-supplied name when the environment is empty
• OTEL_SERVICE_NAME and OTEL_RESOURCE_ATTRIBUTES override that default, with OTEL_SERVICE_NAME winning between the two
• Chart-injected attributes land alongside the defaults, and the schema URL is preserved
• InitTracing leaves every OTEL_* variable untouched in the environment
• A malformed OTEL_RESOURCE_ATTRIBUTES entry keeps the parseable attributes and lets initialization succeed
• With no transport variables set, the exporter reaches a plaintext collector on the loopback default
• An operator's endpoint, insecure flag and certificate still decide the transport (existing OTLP coverage from tracing: honor OTLP TLS and auth environment variables #2312 unchanged)
• Tests pass with OTEL_SERVICE_NAME, OTEL_RESOURCE_ATTRIBUTES and OTEL_EXPORTER_OTLP_ENDPOINT already set in the environment
• Verified on a kind dev stack with an OpenTelemetry collector sidecar on the pod loopback: spans arrive carrying service.name=llm-d-epp with no OTEL_SERVICE_NAME set, plus k8s.namespace.name, k8s.node.name and k8s.pod.name, at schema URL 1.37.0

Release note (write NONE if no user-facing change):

Spans exported by EPP and the disaggregated sidecar now carry `service.name` and the attributes from `OTEL_RESOURCE_ATTRIBUTES`, including the `k8s.namespace.name`, `k8s.node.name` and `k8s.pod.name` values set by the Helm chart. These were previously never applied to the exported resource, so spans reached the collector without service identity.

[ahg-g]

How is this default value applied now?

[satyamg1620]

Thanks @ahg-g for the review.

The SDK supplies the endpoint: NewGRPCConfig seeds localhost:4317 before it applies env config or explicit options (options.go#L115-L131). But it negotiates TLS for that default, and #2312 removed the hardcoded WithInsecure — so the http:// scheme in the old os.Setenv value was what selected plaintext. Dropping it outright broke the local collector path: tls: first record does not look like a TLS handshake, 0 spans delivered.

Pushed a fix that pins the endpoint and the insecure transport, but only when the environment sets none of the endpoint, insecure or certificate variables. As soon as one is set the options are dropped, so an operator's OTEL_EXPORTER_OTLP_ENDPOINT and its scheme still decide where spans go and how the connection is secured.