fix(appsec): keep first redirect hop for redirection derivatives (#4972)

### What does this PR do?

Merges WAF attribute derivatives with **first-write-wins** in `AbsorbDerivatives` so a uniform-status redirect chain reports the **first** hop's `appsec.api.redirection.*` value instead of the last.

It also enables the `APPSEC_RASP_NON_BLOCKING` scenario in the system-tests CI matrix (across all weblog variants, matching `APPSEC_RASP`) so this stays covered.

### Motivation

#4938 moved per-hop downstream request/response WAF evaluation from the persistent request context to per-roundtrip **ephemeral subcontexts**. The persistent context deduplicates attribute generation within a request, so a redirection attribute rule matching the same status (e.g. 302) on every hop produced its derivative only once (the first hop). Ephemeral subcontexts don't share that dedup, so the rule re-fires on every hop and `AbsorbDerivatives`' last-write-wins kept the **final** hop.

This regressed system-tests `Test_API10_redirect_status::test_api10_redirect` on `golang@2.10.0-dev` (bisected to `40280d189`): `appsec.api.redirection.move_target` became `/mirror/200` (last hop) instead of `/redirect?totalRedirects=2` (first hop).

The fix restores the pre-#4938 "first discovery wins" invariant at the derivative merge boundary while preserving #4938's per-hop ephemeral evaluation (RASP SSRF still fires on every hop). The existing blocked-response-schema skip is kept ahead of the new guard.

### Testing

- New `TestAppsecHTTP30XRedirectChainKeepsFirstHop` (uniform-302 chain) — verified it FAILS without the fix and PASSES with it. The existing `TestAppsecHTTP30X` used distinct 308/307 per hop, so it never collided on a single key.
- New `AbsorbDerivatives` unit tests (first-write-wins + blocked-response-schema skip preserved).
- Full `contrib/net/http` appsec suite and `internal/appsec/emitter/waf` package pass; `go vet` clean.

### Reviewer's Checklist

- [x] Changed code has unit tests for its functionality at or near 100% coverage.
- [x] [System-Tests](https://github.com/DataDog/system-tests/) covering this feature have been enabled (`APPSEC_RASP_NON_BLOCKING` added to the CI matrix).
- [ ] There is a benchmark for any new code, or changes to existing code.
- [ ] If this interacts with the agent in a new way, a system test has been added.
- [x] New code is free of linting errors.
- [x] New code doesn't break existing tests.
- [ ] Add an appropriate team label so this PR gets put in the right place for the release notes.
- [x] All generated files are up to date.
- [ ] Non-trivial go.mod changes reviewed by @DataDog/dd-trace-go-guild (no go.mod changes).


Co-authored-by: eliott.bouhana <eliott.bouhana@datadoghq.com>

Author: eliottness

.github/workflows/system-tests.yml

@@ -141,6 +141,7 @@ jobs:
           - APPSEC_BLOCKING_FULL_DENYLIST
           - APPSEC_API_SECURITY
           - APPSEC_RASP
+          - APPSEC_RASP_NON_BLOCKING
           - APPSEC_RUNTIME_ACTIVATION
           - APM_TRACING_E2E_SINGLE_SPAN
           - APM_TRACING_E2E_OTEL

contrib/net/http/appsec_test.go

@@ -328,3 +328,62 @@ func TestAppsecHTTP30X(t *testing.T) {
 	// But we have not analyzed any of the redirect response bodies
 	assert.NotContains(t, serviceSpan.Tags(), "_dd.appsec.trace.3xx_res_body")
 }
+
+// TestAppsecHTTP30XRedirectChainKeepsFirstHop guards against the #4938 regression surfaced by
+// system-tests Test_API10_redirect_status: when every hop of a redirect chain returns the SAME
+// status (302 here), the same api-010 rule fires on every hop and writes the same redirection
+// attribute from each hop's Location header. The value reported must be the FIRST hop's, not the
+// last. Per-hop ephemeral WAF subcontexts (#4938) had regressed this to last-write-wins.
+func TestAppsecHTTP30XRedirectChainKeepsFirstHop(t *testing.T) {
+	t.Setenv("DD_APPSEC_RULES", "../../../internal/appsec/testdata/api10.json")
+
+	// Uniform-302 chain: /redirect?totalRedirects=3 -> 2 -> 1 -> 0 -> /final, mirroring the
+	// system-tests internal_server. api10.json's api-010-110 rule maps 302 -> redirect_target.
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case strings.HasPrefix(r.URL.Path, "/redirect"):
+			n, _ := strconv.Atoi(r.URL.Query().Get("totalRedirects"))
+			loc := "/final"
+			if n > 0 {
+				loc = fmt.Sprintf("/redirect?totalRedirects=%d", n-1)
+			}
+			http.Redirect(w, r, loc, http.StatusFound)
+		case r.URL.Path == "/final":
+			w.WriteHeader(http.StatusOK)
+		default:
+			require.Failf(t, "unexpected request", "path: %s", r.URL.Path)
+		}
+	}))
+	defer srv.Close()
+
+	httpClient := WrapClient(srv.Client())
+
+	mt := mocktracer.Start()
+	defer mt.Stop()
+
+	testutils.StartAppSec(t)
+
+	w := httptest.NewRecorder()
+	r, err := http.NewRequest("GET", srv.URL+"/redirect?totalRedirects=3", nil)
+	require.NoError(t, err)
+
+	TraceAndServe(http.HandlerFunc(func(_ http.ResponseWriter, r *http.Request) {
+		resp, err := httpClient.Do(r)
+		require.NoError(t, err)
+		if resp != nil && resp.Body != nil {
+			defer resp.Body.Close()
+		}
+	}), w, r, &ServeConfig{
+		Service:  "service",
+		Resource: "resource",
+	})
+
+	spans := mt.FinishedSpans()
+
+	// 1 handler span + 5 downstream requests (4x 302 + the final 200).
+	require.Len(t, spans, 6)
+	serviceSpan := spans[len(spans)-1]
+
+	assert.Equal(t, "/redirect?totalRedirects=2", serviceSpan.Tags()["appsec.api.redirection.redirect_target"], "redirect_target must reflect the FIRST redirect hop, not the last")
+	assert.Equal(t, float64(5), serviceSpan.Tags()["_dd.appsec.downstream_request"], "unexpected or missing _dd.appsec.downstream_request tag")
+}

internal/appsec/emitter/waf/context.go

@@ -168,6 +168,14 @@ func (op *ContextOperation) AbsorbDerivatives(derivatives map[string]any) {
 			continue
 		}
 
+		// First-write-wins, intentionally: ephemeral subcontexts (e.g. per-hop downstream
+		// evaluation of a redirect chain) don't share the WAF's in-context attribute dedup, so
+		// without this guard the last hop would overwrite the first. Keeping the first value makes
+		// appsec.api.redirection.move_target reflect the FIRST redirect hop, not the last.
+		if _, ok := op.derivatives[k]; ok {
+			continue
+		}
+
 		op.derivatives[k] = v
 	}
 }

internal/appsec/emitter/waf/context_test.go

@@ -60,6 +60,42 @@ func TestFinishedServiceEntrySpanDoesNotReceiveChildDataEvents(t *testing.T) {
 	}
 }
 
+func TestAbsorbDerivativesFirstWriteWins(t *testing.T) {
+	op := &ContextOperation{}
+
+	op.AbsorbDerivatives(map[string]any{"appsec.api.redirection.move_target": "/first", "count": 1})
+	op.AbsorbDerivatives(map[string]any{"appsec.api.redirection.move_target": "/second", "count": 2, "added": true})
+
+	got := op.Derivatives()
+	if v := got["appsec.api.redirection.move_target"]; v != "/first" {
+		t.Errorf("move_target = %v, want /first (first write must win)", v)
+	}
+	if v := got["count"]; v != 1 {
+		t.Errorf("count = %v, want 1 (first write must win)", v)
+	}
+	if v, ok := got["added"]; !ok || v != true {
+		t.Errorf("added = %v (present=%v), want true (a new key must still be absorbed)", v, ok)
+	}
+}
+
+func TestAbsorbDerivativesBlockedResponseSchemaStillSkipped(t *testing.T) {
+	op := &ContextOperation{}
+	op.SetRequestBlocked()
+
+	op.AbsorbDerivatives(map[string]any{
+		"_dd.appsec.s.res.body":              "schema",
+		"appsec.api.redirection.move_target": "/first",
+	})
+
+	got := op.Derivatives()
+	if _, ok := got["_dd.appsec.s.res.body"]; ok {
+		t.Error("response schema derivative must be skipped when the request is blocked")
+	}
+	if v := got["appsec.api.redirection.move_target"]; v != "/first" {
+		t.Errorf("move_target = %v, want /first (non-schema derivatives must still be absorbed when blocked)", v)
+	}
+}
+
 type recordingTagSetter struct {
 	mu   sync.Mutex
 	tags map[string]any