fix: Allow overriding server fetch dependency (#9803)

* Fixes #9803 by allowing custom `fetch` invalidation dependcy in
  server `load` which prevents default behavior of exposing all
  (including private) urls to clients.

Author: malviyaritesh

packages/kit/src/runtime/server/page/load_data.js

@@ -51,7 +51,8 @@ export async function load_server_data({ event, state, node, parent }) {
 				);
 			}
 
-			uses.dependencies.add(url.href);
+			// @ts-expect-error: Property 'svelte' does not exist on type 'RequestInit'.
+			uses.dependencies.add(init?.svelte?.depends ?? url.href);
 
 			return event.fetch(info, init);
 		},

packages/kit/test/apps/basics/src/routes/load/invalidation/server-fetch/private/+page.server.js

@@ -0,0 +1,11 @@
+/** @type {import('./$types').PageServerLoad} */
+
+import { PRIVATE_STATIC } from '$env/static/private';
+
+export async function load({ fetch }) {
+	return {
+		time: fetch(`http://worldtimeapi.org/api/ip?PRIVATE=${encodeURIComponent(PRIVATE_STATIC)}`, {
+			svelte: { depends: 'app:hidden-time-api' }
+		}).then((res) => res.json())
+	};
+}

packages/kit/test/apps/basics/src/routes/load/invalidation/server-fetch/private/+page.svelte

@@ -0,0 +1,15 @@
+<script>
+	import { invalidate } from '$app/navigation';
+
+	export let data;
+</script>
+
+<h1>Server Private Fetch</h1>
+
+<p>Time: {new Date(data.time.datetime)}</p>
+
+<p>
+	<button on:click={e => invalidate('app:hidden-time-api')}>
+		Fetch Current Time
+	</button>
+</p>