feat(packages): symlinked .runfile pkgs should not be usercode (#13474) [backport 2.21]

[tylfin]

This came up again so I'll backport to 2.21 - https://datadoghq.atlassian.net/browse/DEBUG-4257

---

While dogfooding, we noticed that code origins was still sending third-party code for bazel, e.g. this path:

/app/domains/dashboardsnotebooks_backend/sharing/apps/apis/shared_dd_query/shared_dd_query.runfiles/dd_source/external/pypi_linux_x86_64_ddtrace/site-packages/ddtrace/_trace/tracer.py

We have code specifically to handle the *.runfiles path, but we pass the string to a Path and call the resolve which removes the *.runfiles segment.

To fix this, we update the path resolution logic in ddtrace/internal/packages.py to improve handling of symlinks and add a new test to ensure correct behavior when symlinks are involved.

• ddtrace/internal/packages.py: Updated _root_module to use path instead of path.resolve() to ensure symlinks are searched properly. Similarly, updated filename_to_package to use path for consistent path handling. [1] [2]

• tests/internal/test_packages.py: Added test_third_party_packages_symlinks to verify that symlinks, particularly those with .runfiles in their paths, are correctly excluded from being identified as user code. This ensures the logic remains robust in environments with symlinked directories.

Refs: DEBUG-3926, DEBUG-4257

(cherry picked from commit 197dbe2)

Checklist

• PR author has checked that all the criteria below are met
• The PR description includes an overview of the change
• The PR description articulates the motivation for the change
• The change includes tests OR the PR description describes a testing strategy
• The PR description notes risks associated with the change, if any
• Newly-added code is easy to change
• The change follows the library release note guidelines
• The change includes or references documentation updates if necessary
• Backport labels are set (if applicable)

Reviewer Checklist

• Reviewer has checked that all the criteria below are met
• Title is accurate
• All changes are related to the pull request's stated goal
• Avoids breaking API changes
• Testing strategy adequately addresses listed risks
• Newly-added code is easy to change
• Release note makes sense to a user of the library
• If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment
• Backport labels are set in a manner that is consistent with the release branch maintenance policy

[github-actions]

CODEOWNERS have been resolved as:

ddtrace/internal/packages.py                                            @DataDog/apm-core-python
tests/debugging/origin/test_span.py                                     @DataDog/debugger-python
tests/internal/test_packages.py                                         @DataDog/apm-core-python

[github-actions]

This pull request has been automatically closed after a period of inactivity.
After this much time, it will likely be easier to open a new pull request with the
same changes than to update this one from the base branch. Please comment or reopen
if you think this pull request was closed in error.