feat: Issue #3285819: Allow bypassing shield based on the request user agent.

Jakob Prequested to merge
issue/shield-3285819:3285819-configuration-for-bypassing into 8.x-1.x

Adds a "User agent allowlist" exception, so requests whose user agent contains one of the configured strings are let through the shield. The typical use case is a crawler such as facebookexternalhit that has to reach a page an SSO flow depends on, which no IP or domain allowlist can express.

Reworked from the patch in comment #2:

  • Uses the generic "user agent" terminology rather than "crawler", and warns on the form that the user agent is client supplied and therefore not a security boundary.
  • Reads the user agent from the request object instead of $_SERVER, so the check is testable and does not depend on the global state.
  • Drops a stray reference to an undefined variable in handle() and a duplicated credential_provider assignment in the settings form.
  • Adds the config schema entry, the default value and shield_update_8010() that the patch was missing, so existing sites pick the setting up.
  • Adds kernel test coverage for the matching behavior and for the debug header.

Closes #3285819

Merge request reports