✨ [RUMF-1175] collect reports and csp violation

[amortemousque]

Motivation

Collect reports and csp violation.
Feature under feature flag

Worth reviewing commit by commit

Changes

• add a reportObserbvable
• collect error reports in RUM
• collect all reports in Logs

Testing

• Local
• Staging
• Unit
• End to end

---

I have gone over the contributing documentation.

[codecov-commenter]

Codecov Report

Merging #1332 (7124d93) into main (e58d489) will increase coverage by 0.07%.
The diff coverage is 94.49%.

@@            Coverage Diff             @@
##             main    #1332      +/-   ##
==========================================
+ Coverage   89.75%   89.83%   +0.07%     
==========================================
  Files         102      105       +3     
  Lines        4207     4297      +90     
  Branches      944      956      +12     
==========================================
+ Hits         3776     3860      +84     
- Misses        431      437       +6     

Impacted Files	Coverage Δ
...omain/rumEventsCollection/error/errorCollection.ts	70.83% <0.00%> (-3.08%)	⬇️
...main/rumEventsCollection/error/trackReportError.ts	77.77% <77.77%> (ø)
packages/core/test/stubReportApis.ts	93.33% <93.33%> (ø)
...ackages/core/src/domain/report/reportObservable.ts	97.36% <97.36%> (ø)
packages/core/src/tools/error.ts	90.62% <100.00%> (+0.62%)	⬆️
packages/core/src/tools/utils.ts	86.69% <100.00%> (+0.06%)	⬆️
packages/logs/src/boot/startLogs.ts	85.54% <100.00%> (+2.20%)	⬆️
packages/logs/src/domain/configuration.ts	100.00% <100.00%> (ø)

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update e58d489...7124d93. Read the comment docs.

[amortemousque]

After some thought, I think it is valuable to add the originalPolicy to the crafted message.
Could be done like so:
${event.blockedURI}' blocked by '${event.effectiveDirective}' directive of the policy "${event.originalPolicy}"

This way we will have message like:

• 'Blob' blocked by 'worker-src' directive of the original policy "worker-src 'none'"
• 'http://httpbin.google.com/script.js' blocked by 'script-src-elem' directive of the policy "default-src 'self' 'unsafe-inline' https://httpbin.org http://httpbin.org google.com"

[amortemousque]

@bcaudan @BenoitZugmeyer

[bcaudan]

Some directives could list a large number of domains 🤔
I'd say that it could be added in the stack to keep a minimal message.
We should maybe also truncate the policy to avoid sending too much data.

[amortemousque]

I added it to the stack. Let me know what you think

[BenoitZugmeyer]

LGTM!