[APPSEC]: report blocking_response payload and status code on blocked response

[florentinl]

What does this PR do?

This PR ensures that when a request is blocked, the reported captured response and http.status_code comes from the blocking_response instead of the response.

Motivation

Currently, when enabling Appsec and a request is blocked. The span will still report the status code of the response that was blocked instead of the automatic blocking response and if the request was blocked before the function handler was called the default value of 502 would be returned.

Testing Guidelines

• updated unit tests to avoid regressions

Additional Notes

• I am making a pass of manual testing before making appsec through the tracer the default and spot this bug

Types of Changes

• Bug fix
• New feature
• Breaking change
• Misc (docs, refactoring, dependency upgrade, etc.)

Check all that apply

• This PR's description is comprehensive
• This PR contains breaking changes that are documented in the description
• This PR introduces new APIs or parameters that are documented and unlikely to change in the foreseeable future
• This PR impacts documentation, and it has been updated (or a ticket has been logged)
• This PR's changes are covered by the automated tests
• This PR collects user input/sensitive content into Datadog
• This PR passes the integration tests (ask a Datadog member to run the tests)

[joeyzhao2018]

not a request to change but I wonder if we should still tag the original self.response? maybe like tage it "function.original_request"? Does being blocked means we don't want the customer to see the original response whatsoever?

[florentinl]

We don't particularly want to hide it from the customer, the question is rather: would it be useful to have it ? The security signal will already have a detail of which security rule was matched to trigger the block. Having the response might be handy for debugging.

The request can be blocked at multiple moments. We would only have an "original response" when we block after looking at the response of the handler.
In this case, I can tag a "function.blocked_response" to link it more explicitly with the blocking feature.

[joeyzhao2018]

LGTM