sdk/log: Prevent exporting attributes with empty keys

[pellared]

Description

The Logs API and SDK retain attributes whose key is the empty string, allowing invalid LogRecord and Instrumentation Scope attributes to reach processors and exporters.

The Stable Common Attribute specification requires an attribute key to be a non-null, non-empty, case-sensitive string (specification). The shared attribute package already identifies an empty key as invalid: Key.Defined returns false and KeyValue.Valid delegates to it (attribute/key.go, attribute/kv.go).

The Logs paths do not apply that validation:

• API Record.AddAttributes appends every supplied KeyValue (implementation).
• SDK Record.AddAttributes and SetAttributes normalize, deduplicate, and limit attributes without rejecting empty keys (implementation).
• Instrumentation attributes are stored in an unfiltered attribute.Set, and the SDK provider does not filter invalid top-level Scope attributes (API option, provider).
• OTLP transformation copies the exact key into protocol KeyValue messages for both Scope and LogRecord attributes (Scope transformation, LogRecord transformation).

Current SDK tests explicitly retain empty-key attributes in both duplicate-retention and default modes (tests, default mode). Resource handling provides a repository precedent by filtering with kv.Valid() (sdk/resource/resource.go).

Related compliance audit: #8553.

Environment

• OS: Linux
• Architecture: x86_64
• Go Version: go1.26.4
• opentelemetry-go version: 0de413a318cb52629baefb89a1554a905e105aa3

Steps To Reproduce

1. Create a LogRecord with attribute.String("", "record value").
2. Create a Logger with log.WithInstrumentationAttributes(attribute.String("", "scope value")).
3. Emit the record through an SDK LoggerProvider with a processor or exporter that captures the result.
4. Observe an empty-key entry in the LogRecord attributes and Instrumentation Scope attributes; OTLP and stdout exporters preserve it.

Expected behavior

Empty-key attributes should not reach processors or exporters. Validation should be applied consistently to LogRecord and Instrumentation Scope attributes while preserving valid key case and values. Add API-to-export regression tests for both paths.

The implementation should explicitly decide whether rejected invalid entries affect DroppedAttributes or emit a diagnostic instead of treating that behavior as an ordinary collection-limit drop.

_{Tip: React with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding +1 or me too, to help us triage it. Learn more here.}