browser: flags to control iwa enabled server whitelist

[deepak1556]

Since v0.37 there is no URLSecurityManager directly configured by brightray, instead we need to set the whitelist with HttpAuthPreferences. This makes app.allowNTLMCredentialsForAllDomains obsolete, have introduced flags which mimic chromes' behavior. This will be a breaking change. Also should DisableAuthNegotiateCnameLookup and EnableAuthNegotiatePort be added ?

Ref https://www.chromium.org/developers/design-documents/http-authentication

Fixes #4825

Depends on electron-archive/brightray#223

/cc @paulcbetts

[deepak1556]

Actually could bring back app.AllowNTLMCredentialsForAllDomains by setting auth-server-whitelist=* internally, that way it wouldnt be breaking change. Thoughts ?

[anaisbetts]

@deepak1556 This sounds good, we could just make the allowNTLMCredentialsForAllDomains just add command-line flags and require that you have to move it before ready

[deepak1556]

Fixed, thanks!

[deepak1556]

Have deprecated app.allowNTLMCredentialsForAllDomains and replaced with generic session.allowNTLMCredentialsForDomains. Not sure if this the right way to deprecate.

[zcbenz]

👍