chore(deps): update dependency @opentelemetry/core to v1.28.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@opentelemetry/core (source)	1.27.0 -> 1.28.0

---

Release Notes

open-telemetry/opentelemetry-js (@​opentelemetry/core)

v1.28.0

Compare Source

🚀 (Enhancement)

• feat(sdk-metrics, sdk-trace): add mergeResourceWithDefaults flag, which allows opting-out of resources getting merged with the default resource #​4617

  • default: true (no change in behavior)
  • note: false will become the default behavior in the next major version in order to comply with specification requirements

• feat(sdk-trace-base): add spanProcessors property in TracerConfig interface. #​5138 @​david-luna

🐛 (Bug Fix)

• fix(sdk-metrics): await exports in PeriodicExportingMetricReader when async resource attributes have not yet settled #​5119 @​pichlermarc
• fix(sdk-trace): performance.now() may return the same value for consecutive calls #​5150 @​dyladan
• fix(sdk-trace-base): pass BatchSpanProcessor#forceFlush() errors on visibilitychange/pagehide to globalErrorHandler #​5143 @​pichlermarc
  • fixes a bug where switching browser tabs with a failing exporter would cause an unhandled error

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/@opentelemetry/core	1.28.0	🟢 5.8	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Security-Policy 🟢 10 security policy file detected Fuzzing ⚠️ 0 project is not fuzzed SAST 🟢 10 SAST tool is run on all commits Vulnerabilities ⚠️ 0 21 existing vulnerabilities detected

Scanned Files

• package-lock.json