[Session Replay] Add ability to mask or suppress touch input over sensitive views and WebViews

[bengineerdavis]

Problem Statement

When Session Replay is enabled, raw touch coordinates (taps and swipes) are recorded globally across the screen, even when the user is interacting with visually masked elements like password fields, custom keypads, or sensitive WebViews.

This creates a PII and security vulnerability. Observers can reconstruct user PINs and passwords simply by watching where the tap indicators land over a visually redacted WebView.

Today, sentry-java provides no mechanism to suppress touch recording over visually masked view boundaries, nor does it offer a programmatic API (like pauseTouchTracking()) to temporarily disable gesture capture during sensitive user flows without completely shutting down the replay engine.

Impact

• Enterprise customers are blocked from shipping because replays leak credential entry patterns.
• Current view masking (screenshot redaction) is undermined by unfiltered touch events.

Possible Approaches

1. View-boundary filtering: During touch dispatch or conversion, check whether the event coordinates fall inside a view that is configured to be masked (e.g., via SentryMaskingOptions or sentry-mask tags) and drop the event if so.
2. Programmatic pause: Add a public API (e.g., SentryReplayOptions or ReplayController) to pause/resume only gesture recording without stopping screenshot capture.

[linear-code]

JAVA-658

[sentry-pierre]

Removed the empty "No response" placeholder and structured the issue so the concrete security gap is easier to scan.