Affected: Go: go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc

### Summary

The grpc Unary Server Interceptor [opentelemetry-go-contrib/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/9d4eb7e7706038b07d33f83f76afbe13f53d171d/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go#L327)

``` // UnaryServerInterceptor returns a grpc.UnaryServerInterceptor suitable // for use in a grpc.NewServer call. func UnaryServerInterceptor(opts ...Option) grpc.UnaryServerInterceptor { ``` out of the box adds labels

- `net.peer.sock.addr` - `net.peer.sock.port`

that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent.

### Details

An attacker can easily flood the peer address and port for requests.

### PoC

Apply the attached patch to the example and run the client multiple times. Observe how each request will create a unique histogram and how the memory consumption increases during it. ### Impact

In order to be affected, the program has to configure a metrics pipeline, use [UnaryServerInterceptor](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/9d4eb7e7706038b07d33f83f76afbe13f53d171d/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go#L327), and does not filter any client IP address and ports via middleware or proxies, etc.

### Others

It is similar to already reported vulnerabilities.

* [GHSA-rcjv-mgp8-qvmr](https://github.com/open-telemetry/opentelemetry-go-…