fix(core): Deduplicate native HTTP breadcrumbs for URLs with a query string

[antonis]

📢 Type of change

• Bugfix
• New feature
• Enhancement
• Refactoring

📜 Description

URLs are now normalized before comparing:

• JS URL: the query and fragment are cut off while the URL is still encoded. Then credentials are removed, the scheme and host are lowercased, the URL is decoded, and a trailing slash is dropped.
• Native URL: credentials are removed, the scheme and host are lowercased, and the URL is decoded. It is not cut at ?, because after decoding a ? may belong to the path.
• Match: the native URL must equal the JS URL, or be the JS URL followed by /, ?… or /?…. Identical raw URLs still always match.

💡 Motivation and Context

Fixes #6872

💚 How did you test it?

CI, Manual

📝 Checklist

• I added tests to verify changes.
• No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
• I updated the docs if needed.
• I updated the wizard if needed.
• All tests passing.
• Public API changes reviewed by another Mobile SDK team member or implemented according to the develop docs spec.
• No breaking changes.

🔮 Next steps

[github-actions]

Semver Impact of This PR

⚪ None (no version bump detected)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

---

• fix(core): Deduplicate native HTTP breadcrumbs for URLs with a query string by antonis in #6881

• chore(deps): bump futureware-tech/simulator-action from 5 to 6 by dependabot in #6878
• chore(deps): bump getsentry/craft from 2.33.1 to 2.34.1 by dependabot in #6880
• chore(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 by dependabot in #6879
• chore(deps): bump ruby/setup-ruby from 1.327.0 to 1.328.0 by dependabot in #6877
• chore(deps): bump the codeql-action group with 3 updates by dependabot in #6876
• build(deps): Pin tinypool to patched 2.x to resolve prototype-pollution advisories by antonis in #6869
• build(deps): Bump sharp, shell-quote and smol-toml to patched versions by antonis in #6868
• fix(core): Do not mark sendDefaultPii as deprecated in React Native options by alwx in #6864
• ci(ios): Archive the SwiftPM app to catch xcframework signature collisions by alwx in #6871
• feat(core): Support applicationKey and moduleMetadata in Metro config by alwx in #6863
• chore(deps): update JavaScript SDK to v10.76.2 by antonis in #6866
• ci(core): Guard the "sideEffects": false contract with a lint check by antonis in #6836
• chore(deps): bump nx from 22.7.7 to 22.7.12 by dependabot in #6857
• chore(deps): bump compression from 1.7.5 to 1.8.2 by dependabot in #6856
• chore(deps): bump postcss-selector-parser from 7.1.4 to 7.1.6 by dependabot in #6855
• chore(deps): bump source-map-js from 1.2.1 to 1.2.2 by dependabot in #6854
• chore(deps): bump proxy-addr from 2.0.7 to 2.0.8 by dependabot in #6853
• chore(deps): bump handlebars from 4.7.9 to 4.7.10 by dependabot in #6862
• chore(deps): update Wizard to v8.0.1 by github-actions in #6852

---

_{🤖 This preview updates automatically when you update the PR.}

[github-actions]

	Fails
🚫	Pull request is not ready for merge, please add the "ready-to-merge" label to the pull request

Generated by 🚫 dangerJS against 2de5669

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 2de5669. Configure here.}