…w#1460)

* Add browser-plugin-bot-detection wrapping FingerprintJS BotD

Introduces a new browser tracker plugin that detects bots client-side
using @fingerprintjs/botd and attaches the result as a
client_side_bot_detection context entity to all tracked events.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Fixes snowplow#1464

The `sha1` npm package references `Buffer.isBuffer()` internally. Bundlers like webpack/Next.js see this and inject a **~28 KB Buffer polyfill** into every client page — even though the `Buffer` code path is never reached (we only hash short strings)

On top of that, `sha1` only ships CommonJS, forcing CJS interop on every bundler that consumes the ESM dist

- Remove `sha1` and `@types/sha1` dependencies
- Add a ~90-line inline SHA-1 (FIPS 180-4) that only handles UTF-8 strings — which is all the tracker needs
- Tests cover RFC 3174 vectors plus the actual domain-hash values to ensure identical output

- **-28 KB raw / ~7 KB gzipped** from every page for Next.js / webpack 5 users
- Eliminates the last CJS dependency in `browser-tracker-core`
- No API or behavioral changes

…wplow#1469)

* Update bundlemon to version 3 to fix CI failures on change check

* Add permissions for check workflow

* Only run when triggered from the same repo

* Tweak max size limits

# 50-character subject line
#   * Present tense
#
# 72-character wrapped longer description. This should answer:
#   * Why was this change necessary?
#   * How does it address the problem?
#   * Are there any side effects?

…nowplow#1468)

Co-authored-by: James Shebester <James.Shebester@optimizely.com>

…nowplow#1467)

* Add opt-in extended activity tracking with activity_metrics entity

Attach quantitative activity metrics (mouse distance, scroll distance,
key presses, clicks, touches) to page_ping events when
extendedActivityTracking is enabled. Reuses existing DOM event handlers
with zero overhead when the feature is off.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Add change files

* Add API extractor changes

* Address review feedback

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Upgrades @docusaurus/core and related packages from 3.4.0 to 3.10.0 and adds
npm overrides for serialize-javascript, lodash, and webpackbar to clear the
remaining high-severity transitive vulnerabilities flagged by Snyk
(node-forge, svgo, minimatch, brace-expansion, serialize-javascript RCE,
lodash prototype pollution). npm audit now reports 0 vulnerabilities and
docusaurus build succeeds.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>