Update automatic beacon explainer for new sending behavior

[blu25]

Automatic beacons will now send to all URLs that registered with the reserved.top_navigation event type, regardless of what data was set when calling setReportEventDataForAutomaticBeacons(). However, automatic beacon data will only be included in the beacon if the beacon's destination is specified in the destination field when calling setReportEventDataForAutomaticBeacons().

[maciejkowalczyk]

Will this change also affect ad component fenced frames?
They would no longer need to call setReportEventDataForAutomaticBeacons as their beacons were already not allowed to send any data.

[blu25]

Will this change also affect ad component fenced frames?

Yes. This will change the behavior of all automatic beacons, regardless of the frame they originate from.

They would no longer need to call setReportEventDataForAutomaticBeacons as their beacons were already not allowed to send any data.

Correct. Now, any registered destinations will get automatic beacons without the component ad needing to do anything.

[JensenPaul]

@shivanigithub, would you like to review this PR?

[blu25]

@maciejkowalczyk There's an update on this feature. We got pushback during a security review and need to modify how this feature behaves. Frames will still need to call setReportEventDataForAutomaticBeacons() so that they have an opportunity to opt in to information being sent to a potentially remote origin (without the opt-in, this could potentially create a cross-origin information leak if the frame doesn't want the information being sent out). However, they won't need to specify destinations in the destination field for them to receive the beacon; that will still only control whether eventData is included in the beacon, and every registered destination will get a beacon after setReportEventDataForAutomaticBeacons() is called at least once.

What this means for ad components is that they will still need to call setReportEventDataForAutomaticBeacons() at least once to opt in, but they only need to specify the eventType and can leave the destination field as [].

[shivanigithub]

lgtm, thanks!