Add a fallback to inferred route for AppSec Api security sampler

[y9v]

What does this PR do?
This PR changes AppSec::APISecuity::RouteExtractor to infer the route if it cannot be extracted, instead of falling back to request path. This route is then used for AppSec API security sampler.

Motivation:
We want to have more accurate sampling for requests to barebones Rack applications, or Rack-based frameworks that we don't instrument directly.

Change log entry
None. This is an internal change.

Additional Notes:
APPSEC-59868

How to test the change?
CI.

[datadog-datadog-prod-us1]

✅ Tests

🎉 All green!

❄️ No new flaky tests detected
🧪 All tests passed

🎯 Code Coverage
• Patch Coverage: 104.55%
• Total Coverage: 98.45% (-0.11%)

View detailed report

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: f400f71 | Docs | Datadog PR Page | Was this helpful? Give us feedback!}

[pr-commenter]

Benchmarks

Benchmark execution time: 2025-11-03 13:14:47

Comparing candidate commit f400f71 in PR branch appsec-security-sampling-with-inferred-route with baseline commit f060ebf in branch master.

Found 1 performance improvements and 0 performance regressions! Performance is the same for 43 metrics, 2 unstable metrics.

scenario:profiling - Allocations (baseline)

• 🟩 throughput [+269529.109op/s; +282408.131op/s] or [+5.391%; +5.649%]

[Strech]

I think we should change the route inference interface to encapsulate some additional logic which now exposed to all calls to this module

[github-actions]

Typing analysis

Note: Ignored files are excluded from the next sections.

Untyped methods

This PR introduces 1 partially typed method.

Partially typed methods (+1-0)

❌ Introduced:

sig/datadog/tracing/contrib/rack/route_inference.rbs:16
└── def self?.read_or_infer: (Hash[::String, untyped] request_env) -> ::String?

If you believe a method or an attribute is rightfully untyped or partially typed, you can add # untyped:accept to the end of the line to remove it from the stats.

[Strech]

🌟 Exceptionally well done! 🔥