Add track() API for custom event tracking - #360

🟡 Medium - Custom tracking events exfiltrate full request URLs, including query strings

The new track() path builds its payload from context.getUrl(), so every custom event includes the full request URL rather than just the normalized route. In the Spring MVC integration that URL is explicitly reconstructed with the raw query string, which means applications that instrument benign flows such as password-reset or invite handling will now send any reset tokens, invite codes, or other query-parameter secrets to Aikido on every tracked event. This expands data collection beyond attack reporting and contradicts the documentation, which says track only auto-captures IP address, user agent, and current user.

_{More info - Reply on this comment to give feedback or ignore the issue.}