fix(tracing): Make shouldAttachHeaders not fall back to default values

[Lms24]

This PR fixes a bug in our shouldAttachHeaders function that determines internally if outgoing requests should have headers attached or not.

Previously, we assigned the default values to tracingOrigins as well as tracePropagationTargets and overwrote these defaults, if users provided one (or (unlikely) both) options. In shouldAttachHeaders, we then first tested tracingOrigins for a match and in case there was no match, we'd test tracePropagationTargets. This, however, also meant that if users specified tracingOrigins and an URL didn't match them, there was still a chance that headers would be attached - in case the url matched the tracePropagationTargets' default values.

With this fix, we don't assign default values to either option but check for definedness of them and only if they're both undefined, well fall back to defaults.

Example:

url: /api/test/123
tracingOrigins: []
tracePropTargets: ['localhost', /^\//] // default values

shouldAttachHeaders returned true but should have returned false. This PR fixes this behaviour.

In case, both options are defined, we prefer tracePropagationTargets over tracingOrigins, as defined in the dev specification.

Furthermore, this PR extracts the shouldAttachHeaders function by wrapping it in a factory function so that it's easier to test this behaviour. Also, the PR adds some tests to verify correct behaviour.
We can probably get rid of some code around this in v8 when we finally remove tracingOrigins.

possibly fixes the reopened issue #6077

Side-note: Because we're exporting defaultRequestInstrumentationOptions as public API, I decided to leave the optional value assignment in place but to simply not take the default values from it anymore in instrumentOutgoingRequests (see aed40a6).

[Archi4400]

I'm waiting for this fix!

[Archi4400]

cool

[lobsterkatie]

Admittedly I'm the one you rubber-ducked the approach with, so I think it's a good one, but I think this looks solid overall. Good for you for realizing the bug!

[github-actions]

size-limit report 📦

Path	Size
@sentry/browser - ES5 CDN Bundle (gzipped + minified)	19.51 KB (added)
@sentry/browser - ES5 CDN Bundle (minified)	60.37 KB (added)
@sentry/browser - ES6 CDN Bundle (gzipped + minified)	18.17 KB (added)
@sentry/browser - ES6 CDN Bundle (minified)	53.72 KB (added)
@sentry/browser - Webpack (gzipped + minified)	19.91 KB (added)
@sentry/browser - Webpack (minified)	65.18 KB (added)
@sentry/react - Webpack (gzipped + minified)	19.94 KB (added)
@sentry/nextjs Client - Webpack (gzipped + minified)	45.93 KB (added)
@sentry/browser + @sentry/tracing - ES5 CDN Bundle (gzipped + minified)	26.36 KB (added)
@sentry/browser + @sentry/tracing - ES6 CDN Bundle (gzipped + minified)	24.77 KB (added)