add sendPayloadChecksums config option and implement Bugsnag-Integrity header

[djskinner]

Goal

Add Bugsnag-Integrity request header (where required APIs are available) and implement the sendPayloadChecksums core config option to allow opting out of this behavior.

Bugsnag-Integrity headers are set by default unless the endpoints configuration option is set, in which case they are disabled. This behavior can be overriden with the new sendPayloadChecksums config option.

Design

• Bugsnag-Integrity headers are set where the environment supports it (requires native promises, subtle crypto, and a secure context)
• The behaviour of sendPayloadChecksums was chosen to avoid possible CORS issues where custom endpoints are being used and they are not configured to accept the new Bugsnag-Integrity in requests.

Changeset

• Add sendPayloadChecksums core config option
• Set Bugsnag-Integrity in delivery-fetch, which is used in @bugsnag/web-worker.
• Set Bugsnag-Integrity in delivery-xml-http-request, which is used in @bugsnag/browser.

Testing

• unit tests on delivery-fetch and delivery-xml-http-request
• manually tested using the web-worker example: event appears when integrity header is correct, event does not appear in the dashboard when the integrity header is wrong
• integration tests for browser and web worker
• e2e tests for browser and web worker

[github-actions[bot]]

@bugsnag/browser bundle size diff

	Minified	Minfied + Gzipped
Before	45.89 kB	13.78 kB
After	46.96 kB	14.02 kB
±	⚠️ +1,073 bytes	⚠️ +242 bytes

code coverage diff

<_temporarily disabled_>

Generated by :no_entry_sign: dangerJS against d38cc52145d67ff10541d95f828018b36bc5e6cf

[djskinner]

Do we also need to set this in the delivery-x-domain-request package? I suppose IE8 and 9 won't support an integrity header?

No, XDomainRequest is only available on ie8 and ie9 neither which support the necessary APIs for calculating and setting the integrity header. even ie11 is excluded because it doesn't have full native promise support, hence the typeof Promise !== 'undefined' && Promise.toString().indexOf('[native code]') !== -1 check.