feat: prevent Maximum call stack size exceeded on client-managed requests

[datamweb]

Description
The Debug Toolbar injects HTML and JavaScript into every HTML response by default, which works for full page loads but causes issues for client-managed or partial requests (such as those from HTMX, Unpoly, or Hotwire Turbo) that expect clean HTML fragments. This can result in invalid HTML, duplicated scripts, or JavaScript errors like “Maximum call stack size exceeded.” To address this, support was added to skip Debug Toolbar HTML/JS injection for requests containing specific headers (e.g. HX-Request, X-Unpoly-Request, Turbo-Frame, Turbo-Visit), while still preserving Debugbar response headers for network-level debugging.

I don’t consider this PR a new feature. I believe it could have been to the develop branch, but since it introduces the $disableOnHeaders property, I only PR’d it to the 4.7 branch.

Checklist:

• Securely signed commits
• Component(s) with PHPDoc blocks, only if necessary or adds value (without duplication)
• Unit testing, with >80% coverage
• User guide updated
• Conforms to style guide

[datamweb]

@samsonasik , could you please advise on the best way to fix this rector issue in ToolbarTest.php?
https://github.com/codeigniter4/CodeIgniter4/actions/runs/20474006600/job/58835031436?pr=9852

[michalsn]

As for the Rector error, we probably will have to skip the RemoveExtraParametersRector rule for this test. But maybe there is a better way - I'm not an expert.

[datamweb]

As for the Rector error, we probably will have to skip the RemoveExtraParametersRector rule for this test. But maybe there is a better way - I'm not an expert.

I agree. I’ve disabled RemoveExtraParametersRector for this specific test via the configuration, since the parameter usage is intentional and required for the test behavior.