Add Collector security documentation

[tiffany76]

This PR moves end user security documentation from a README in the Collector core repository to the OTel docs website.

Based on decisions in previous issues and PRs, the following are assumed:

• Security documentation intended for component developers will remain in the README, which will be amended in a follow-up PR.
• Both documents will cross-reference the other.
• The top-level Collector landing page and the Collector configuration page will link to the security documents.

Tracking issue: #3479
Related to: #3227

NOTE: Much of the work for this PR was done by @mjingle in #3652. With her permission, I am building on her efforts.

[tiffany76]

Still lots to do. I'll let everyone know when it's in a state fit for reviewing. 👍

[jpkrohling]

I'm pretty sure we have a guidance somewhere stating that people should not store PII in telemetry data. Perhaps we should reinforce it here, and add a link to that place? Something like: "help you protect telemetry that shouldn't, but might contain sensitive information, such ..."

[tiffany76]

Still searching for the existing guidance, but I've updated the wording as suggested. I'll keep looking for the PII reference.

[tiffany76]

/fix:refcache

[opentelemetrybot]

You triggered fix:refcache action run at https://github.com/open-telemetry/opentelemetry.io/actions/runs/11564524632

[opentelemetrybot]

fix:refcache was successful.

IMPORTANT: (RE-)RUN /fix:all to ensure that there are no remaining check issues.

[tiffany76]

@open-telemetry/sig-security-maintainers, @open-telemetry/collector-approvers, @open-telemetry/docs-approvers: Hi all, I'm asking for a last round of reviews. Please let me know if you'd like me to make any changes.

Also, please see my earlier comment and add your thoughts:

I just reread @jpkrohling's comment about keeping these docs closer to the Collector getting started docs. I know there was some back and forth about it. I don't have a preference either way and will move the files to the Collector docs, if that's what everyone agrees on.

EDIT to add preview links:
Security landing page
Configuration best practices
Hosting best practices

[mx-psi]

This looks good to me for a first version

[reyang]

LGTM, well written!

[tiffany76]

We have an approval from each SIG, so I was thinking we could give it one more day and then merge this on Friday. How does that sound?

@jpkrohling @open-telemetry/docs-approvers

[reyang]

We have an approval from each SIG, so I was thinking we could give it one more day and then merge this on Friday. How does that sound?

@jpkrohling @open-telemetry/docs-approvers

🚢

[chalin]

Overall looks good (did a quick scan, not an in depth read though).
I've added suggested fixes for section-local paths.
I'll let other maintainers give their formal approval for the content.

[tiffany76]

/fix:format

[opentelemetrybot]

You triggered fix:format action run at https://github.com/open-telemetry/opentelemetry.io/actions/runs/11644880315

[opentelemetrybot]

fix:format was successful.

IMPORTANT: (RE-)RUN /fix:all to ensure that there are no remaining check issues.