feat(cloudflare): Auto-instrument the worker entry with withSentry

[JPeer264]

Add sentryCloudflareAutoInstrumentPlugin and fold it into @sentry/cloudflare/vite, so a worker needs no manual Sentry.withSentry wrapping. Using the wrangler config and options module from the previous commit, the plugin rewrites the worker entry's default export to withSentry(<options>, <handler>). Matched by wrangler's main, so it applies in both vite build and vite dev. It is also safe to assume that we only need to touch the main entrypoint, as there all the exports are listed for the actual deployments.

• Add magic-string as a dependency; the transform uses it to rewrite the worker entry source while preserving source maps.
• Add a vite-autoinstrument/default-export integration suite: a plain unwrapped worker whose default export is wrapped at build time via the runner's Vite path.

[semgrep-code-getsentry]

High severity vulnerability may affect your project—review required:
Line 30340 lists a dependency (vite) with a known High severity vulnerability.

ℹ️ Why this matters

Affected versions of vite and vite-plus are vulnerable to Exposure of Sensitive Information to an Unauthorized Actor / Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Vite's server.fs.deny blocklist—which protects sensitive files such as .env and certificate files from being served—can be bypassed on Windows using alternate path representations (NTFS Alternate Data Stream syntax like /.env::$DATA?raw, or 8.3 short filenames), allowing an attacker to read otherwise-denied files when the dev server is exposed to the network.

References: GHSA, CVE

To resolve this comment:
Check if you expose the Vite dev server or vite-plus to the network by configuring a non-loopback address using the --host CLI flag on Windows.

• If you're affected, upgrade this dependency to at least version 7.3.5 at yarn.lock.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}