AppSec discovers service name based on top-level span. Tagging at trace
level results in tags on the trace root span, which is usually Rack's
top-level span.

When request queuing is enabeld, though, a synthetic span is added in
front, representing a service outside the application. This tag then
gets mistakenly tagged with AppSec information, resulting in much
confusion.

The situation gets even trickier with partial flushing, as partially
flushed spans may receive a trace tag.

Ensuring we tag the proper span should solve both issues.

- Create a AppSec::Scope concept to capture toplevel references
- Extract context management out of Processor to the more general Scope class
- Propagate Scope instead of Context through Rack
- Refactor Processor::Context users to find context through Scope instead

…hanged to datadog.appsec.scope