Managed tunnel in core and browser #25460

Ad-blockers drop requests to Sentry's ingest domain. With tunnel: true (or TunnelOptions), the browser SDK sends envelopes to a same-origin path derived from the DSN, and the server SDK forwards them to Sentry.

Core derives the path from the DSN (FNV-1a, base36), matches incoming requests against it in handleTunnelRequest, and filters the tunnel's own request spans. The server's own DSN is always accepted, and allowedDsns adds more. basePath, path and trailingSlash cover apps that don't serve from the root.

The browser SDK resolves tunnel: true to the same path, so no URL has to be configured on either side.

PRs: #25199 (core), #25200 (browser)