[PM-34564] Remove Core & SharedWeb from icons

[justindbaur]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-34564

📔 Objective

This totally decouples the Icons service from the Core project. It moves to the smaller libraries with the same functionality in favor of the monolith. It lights the amount of transitive dependencies the icons service has by quite a lot and is an example for how other services might do the same thing.

📸 Screenshots

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 63.62%. Comparing base (5bed4a0) to head (06aab0e).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8181      +/-   ##
==========================================
- Coverage   63.63%   63.62%   -0.02%     
==========================================
  Files        2344     2344              
  Lines      101961   101958       -3     
  Branches     9205     9204       -1     
==========================================
- Hits        64883    64866      -17     
- Misses      34859    34871      +12     
- Partials     2219     2221       +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

This PR decouples the Icons service from Core and SharedWeb, replacing them with the GlobalSettingsBridge, SerilogFileLogging, and SsrfProtection libraries. I verified behavioral parity for the three replaced middleware paths: the bridge's default CORS policy matches CoreHelpers.IsCorsOriginAllowed (vault origin, file://, bw-desktop-file://bundle, and https://bitwarden.com only when not self-hosted), ConfigureForwardedHeadersOptions matches the previous UseForwardedHeaders(globalSettings) extension including known proxies/networks and forward limit, and IBitwardenEnvironment.SelfHosted resolves from the same globalSettings:selfHosted configuration key. AddMvc() still registers the CORS services required by the parameterless app.UseCors(), and the existing CorsTests and SecurityHeadersTests integration tests exercise both cloud and self-hosted paths against the real host.

Code Review Details

No findings.

The csproj change only swaps project references — no new third-party packages were introduced, and both src/Icons/packages.lock.json and test/Icons.Test/packages.lock.json were regenerated consistently with the manifest change.

[withinfocus]

Huge accomplishment!