feat: downstream x-request-id mirror + webhook HTTP fallback fix

[gclapperton]

Context

This PR is part of a multi-PR effort to guarantee every request handled by broker carries a stable, traceable request ID end-to-end.

• PR feat: guarantee snyk-request-id on every inbound HTTP request [ACC-3093] #1127: HTTP inbound — every request hitting broker's Express server gets snyk-request-id assigned by middleware and echoed in the response.
• PR feat: guarantee snyk-request-id end-to-end across the WebSocket hop #1142: WebSocket inbound — every WS request event payload has snyk-request-id backfilled before it reaches BrokerWorkload.handler.

This PR extends that guarantee outward to the customer system and close a gap in the webhook fallback path.

What problem does this solve?

Gap 1 — Downstream tracing. When broker fires an outbound HTTP request to a customer system (GitHub, GitLab, Jira, etc.), it sends snyk-request-id but never the more standard x-request-id. Tracing systems and proxies on the customer side that key off x-request-id cannot correlate the request back to anything in Snyk's traces.

Gap 2 — Webhook HTTP fallback. The normal webhook flow (SCM → broker-client → WebSocket → broker-server → Snyk API) is fully covered by the other two PRs But when the WebSocket is unavailable, the broker-client falls back to a direct HTTP call to the Snyk API. In that fallback path, whatever snyk-request-id the Snyk API chose to echo could overwrite the UUID the broker had already assigned — breaking the invariant that the broker's ID is the correlation handle for the full round trip.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Partial Token Masking Risk 🟡 [minor] The logic in setRequestIdHeader uses req.url.replaceAll(brokerToken, maskToken(brokerToken)). If a brokerToken happens to be a short or common string that appears elsewhere in the URL path or query parameters (e.g., a short UUID segment matching a project ID), replaceAll will mask those legitimate segments as well. While maskToken helps identify it as a token, it may make debugging difficult by obscuring non-sensitive parts of the URL. ? req.url.replaceAll(brokerToken, maskToken(brokerToken))

📚 Repository Context Analyzed This review considered 14 relevant code sections from 10 files (average relevance: 0.97) lib/hybrid-sdk/server/routesHandlers/httpRequestHandler.ts (lines 1-180) lib/hybrid-sdk/http/downstream-post-stream-to-server.ts (2 segments, lines 1-117) lib/hybrid-sdk/http/request.ts (2 segments, lines 172-401) lib/broker-workload/websocketRequests.ts (2 segments, lines 49-266) lib/hybrid-sdk/requestsHelper.ts (lines 1-137) defaultFilters/github-server-app.json (lines 1842-2116) defaultFilters/github-cloud-app.json (lines 1842-2117) ... and 3 more file(s)

[gclapperton]

introduced in the last PR