…4353)

* feat(csrf): implement modern Fetch Metadata-based protection and enhance origin handling

the implementation is inspired by:
- the go std lib (net/http) implementation: https://github.com/golang/go/blob/5dac42363ba8281a3f4f08e03af2292b763adc38/src/net/http/csrf.go#L122-L163
- the go RFC golang/go#73626 (comment)
- and this article: https://web.dev/articles/fetch-metadata

More references:
- https://developer.mozilla.org/en-US/docs/Glossary/Fetch_metadata_request_header
- https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/CSRF#fetch_metadata

* refactor(tests): remove redundant CSRF test cases while keeping 100% test coverage

* refactor(csrf): replace useFetchMetadata with secFetchSite option for cleaner API

* refactor(csrf): remove OPTIONS method from safe methods in CSRF middleware

* feat(csrf): add test for blocking unknown secFetchSite values and enhance type safety

* tests: use vitest projects

* chore: fix package.json line ending

* test(fastly): stub navigator

* chore(codecov): upgrade action to v5

* chore: remove node environment

* chore: rename main test project

…4360)

* feat(proxy): add `fetch` option to allow custom fetch function

* update the API

* make it optional

* chore: update `typescript` to `5.9.2`

* update `@types/*` to remove the type inconsistencies

* chore: add `packageManager` field to `package.json`

* add a new line