feat: add Google Safe Browsing protection (Linux and Mac)

[younglim]

Summary

• Adds optional Google Safe Browsing URL protection, gated by GOOGLE_SAFE_BROWSING=1 env var
• Uses Chrome's real-time Safe Browsing v5 API (OHTTP hash-prefix lookups) — no local threat database needed
• Works across all scan types: website crawl (crawlDomain), sitemap crawl, intelligent sitemap, and custom flows
• On macOS: works immediately with system Chrome (headful mode)
• On Linux Docker (amd64): uses Xvfb virtual framebuffer to run Chrome headful, since Safe Browsing interstitials are not enforced in headless mode
• Supported: macOS, Linux amd64. Not supported: Windows (prints warning), Linux arm64 (Chrome unavailable)

How it works

1. Chrome is installed in the Docker image (amd64 only)
2. At runtime, ensureAndInjectSafeBrowsing() writes safebrowsing.enabled: true, enhanced: true into the browser profile preferences
3. getPlaywrightLaunchOptions() removes Playwright's default flags that suppress Safe Browsing (--safebrowsing-disable-auto-update, --disable-client-side-phishing-detection, --disable-background-networking)
4. On Linux without a display, Xvfb is started and Chrome runs headful against the virtual framebuffer
5. A 10s warm-up delay gives Chrome time to connect to Google's OHTTP relay before navigating
6. Pages blocked by Safe Browsing land on chrome-error:// and are logged as "Blocked by Safe Browsing"

Key changes

File	Change
src/safeBrowsingProfile.ts	New — DB warmup (skips legacy download for Chrome 128+), preference injection, platform checks, debug logging
src/constants/common.ts	launchPersistentSafeContext() wrapper; getPlaywrightLaunchOptions() removes SB-suppressing flags, starts Xvfb + forces headful when Safe Browsing enabled; 10s warm-up in checkUrl
src/crawlers/commonCrawlerFunc.ts	getPreLaunchHook injects Safe Browsing preferences into each browser pool instance
src/crawlers/crawlDomain.ts	Handles chrome-error:// interstitial pages as excluded with STATUS_CODE_METADATA[3]
src/crawlers/crawlSitemap.ts	Same chrome-error:// handling for sitemap crawls
src/constants/constants.ts	Adds STATUS_CODE_METADATA[3]: "Blocked by Safe Browsing"
Dockerfile	Installs Chrome (amd64 only), installs Xvfb, removes legacy DB seed script

Environment variables

Variable	Purpose
GOOGLE_SAFE_BROWSING=1	Enable Safe Browsing protection
GOOGLE_SAFE_BROWSING_DEBUG=1	Enable Chrome's internal Safe Browsing debug logging

Test plan

• macOS: phishing page blocked with ERR_BLOCKED_BY_CLIENT during checkUrl
• Linux Docker (amd64): Xvfb starts, Chrome runs headful, phishing page blocked
• Non-phishing pages scan normally with Safe Browsing enabled
• Without GOOGLE_SAFE_BROWSING env var, no Safe Browsing overhead (no Xvfb, no warm-up)
• arm64 Docker: prints notice, scans proceed without Safe Browsing
• Windows: prints warning, scans proceed without Safe Browsing
• Safe Browsing blocked pages appear in report as "Blocked by Safe Browsing" (not scanned)

Test on Docker

# Build (amd64 for Chrome support)
docker build --platform linux/amd64 --progress=plain -t oobee .

# Run scan against phishing test page
docker run --platform linux/amd64 --rm -e GOOGLE_SAFE_BROWSING=1 -e OOBEE_VERBOSE=1 oobee node dist/cli.js -u https://testsafebrowsing.appspot.com/s/phishing.html -b chrome -c 2 -k "A11y Team:accessibility@tech.gov.sg" -p 2

# Or share the same dist directory as host
docker run --platform linux/amd64 --rm \
  -v $(pwd)/dist:/app/oobee/dist \
  -e GOOGLE_SAFE_BROWSING=1 -e OOBEE_VERBOSE=1 \
  oobee node dist/cli.js -u https://testsafebrowsing.appspot.com/s/phishing.html -b chrome -c 2 -k "A11y Team:accessibility@tech.gov.sg" -p 2