Configure debug broker support in release mode

[gitaumoses4]

We currently support MSAL trusting debug brokers; however, we need to be sure that people don't set this in error for release builds that we'll be shipped to production.

When the build-type is RELEASE and trust debug brokers is enabled throw a runtime exception.

Implementation

We need to check that the application trusting debug brokers is allowed to do so, hence the BrokerValidator hosts a variable that keeps a record of applications with the ability to trust debug brokers.

[shahzaibj]

Looks like this PR effectively reverts the work we had done to enable debug broker support in release mode to allow automation to be run with prod MSAL and BrokerHost. With this PR we can no longer to do that. I would still like to have support for that. I think RuntimeException is not the right thing to do here. I suggest you schedule a meeting to discuss this work.

[codecov-commenter]

Codecov Report

Merging #1651 (c7f2670) into dev (1c1fcec) will increase coverage by 0.26%.
The diff coverage is 90.00%.

@@             Coverage Diff              @@
##                dev    #1651      +/-   ##
============================================
+ Coverage     15.62%   15.88%   +0.26%     
- Complexity      321      334      +13     
============================================
  Files           164      165       +1     
  Lines          7097     7118      +21     
  Branches        712      716       +4     
============================================
+ Hits           1109     1131      +22     
+ Misses         5815     5814       -1     
  Partials        173      173              

Impacted Files	Coverage Δ
...common/internal/broker/DebugBrokerTrustingApp.java	80.00% <80.00%> (ø)
...entity/common/internal/broker/BrokerValidator.java	33.78% <95.00%> (+16.32%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 3dea002...c7f2670. Read the comment docs.

[shahzaibj]

So what is the plan here? It seems like the only way this is now actually configurable is to first declare trust via BuildConfig, right? So that means the builds that are in Maven central are not actually ever going to be able to trust debug brokers because they are not in debug mode and also don't have trust declared in Build Config. I think that is fine...

My question is how is this debug broker support useful now? I suspect that the plan would be to publish two versions of common going forward to at least the internal maven? One that has debug support declared via BuildConfig and one that doesn't. Is that the correct understanding? If that's the case, I'm not sure if we even need the setShouldTrustDebugBroker method in BrokerValidator at all. I'm not seeing any utility since the functioning is really controlled by build config.

[gitaumoses4]

@shahzaibj as discussed, we are now checking the application's package name and signature hash before allowing it to trust debug brokers.
For a start we allow only MSAL_TEST_APP and MSAL_AUTOMATION_APP to do so.