• fix: allow injection of trustless config
• test: ensure injected config works as expected

Title

fix: allow injection of trustless config

Description

Allows injection of config that is considered untrusted, but only overrides settings that are allowed to be overridden.

We do not allow injection of URLs if the config is considered untrusted.

See discussion at ipfs/helia#824 for more details

Notes & open questions

This PR also removes the dependency on lz-string, reducing initial javascript loaded by about 10kb, but increases size of the ipfs-sw-cfg content by about 200 bytes. This should result in a net reduction in bandwidth usage.

• bandwidth used was +10kb for every new subdomain + 10kb for uncached root domain js.
• bandwidth used is now reduced by 10kb-200bytes for every new subdomain after redirect dance, -10kb for any uncached root domain js

Change checklist

• I have performed a self-review of my own code
• I have made corresponding changes to the documentation if necessary (this includes comments as well)
• I have added tests that prove my fix is effective or that my feature works