Update CoreLibs to 1.23.0

[adguard-octobuddy]

A new CoreLibs version 1.23.0 has been released. Please integrate it.

Changelog: https://github.com/AdGuardSoftwareLimited/core-libs/releases/tag/v1.23.0

Changelog

Added

• Connection Allowlists
  response headers and <iframe> attribute are now patched to allow the injections host.
• An option to enable some dubious hardcoded root CAs on a per-app basis. At this time, only one such CA is hardcoded,
  "C=RU, O=The Ministry of Digital Development and Communications, CN=Russian Trusted Root CA", which should be enabled
  for Yandex Browser to support ad blocking on sites using the russian root CA.
  • [Apple] See ANProxyHttpsFilteringConfig.perAppTrustConfigs and follow documentation links from there.
  • [Android] See com.adguard.corelibs.proxy.ProxyServerConfig.HttpsFiltering#getPerAppTrustConfigs and follow documentation links from there.
  • [Native] See AGPSCProxyHttpsFilteringConfig::perAppTrustConfigs and follow documentation links from there.
  • [Windows] See Adguard.Core.Api.ProxyServer.Configs.HttpsFilteringConfiguration.PerAppTrustConfigurations and follow documentation links from there.
• New /ts endpoint on the injections hosts (local.adguard.org/ts,
  injections.local.org/ts) that returns the injections generation: the time the injected
  content was last changed, in milliseconds since the Unix epoch.
• Add support RFC 10008 HTTP QUERY method in filtered connections, XMLHttpRequests via browser api, and URL filtering rules ($removeparam, $redirect, $queryprune, $method). #2086
• CMakePresets.json, a top-level Makefile and AGENTS.md, matching the setup
  of the neighbouring projects. The presets cover macOS/Linux (clang, with and
  without AddressSanitizer), Windows (MSVC) and statically linked Linux musl
  cross builds for x86_64, aarch64 and armv7 via zig cc. The Apple framework
  (mac/framework) and the Windows DLL (win/corelibs) have preset files of
  their own, and every CI job now builds through them.
• Inject a service-worker cache invalidation bundle (from content-script
  v3.3.0+) into service worker script responses (Sec-Fetch-Dest: serviceworker).
  The bundle periodically polls the /ts endpoint and clears the site's Cache
  Storage when the injections generation changes (protection restart, filter list
  or userscript changes), preventing stale cached content from being served.
  Only the $document exception disables the injection.
• New MCR_SERVICE_WORKER_INJECT value in AGModifiedContentReason to signal
  that a service worker bundle was injected into the response body.
  • [Native] MCR_SERVICE_WORKER_INJECT = 1 << 6 in AGModifiedContentReason
  • [Apple] ANMCRServiceWorkerInject = 1 << 6 in ANModifiedContentReason
  • [Android] SERVICE_WORKER_INJECT(1 << 6) in ModifiedContentReason
  • [Windows] MCR_SERVICE_WORKER_INJECT = 1 << 6 in AGModifiedContentReason

Changed

• Bump native-libs-common to 8.1.42
• Update stealth-script to v2.1.2.
• The default TLS ClientHello split strategy is now TCP-only (AGSP_TCP_FIXED) again, reverting the default to its prior behavior.
• The Chrome-imitating ClientHello — the one sent to the server for a filtered connection, and the
  one of CoreLibs' own HTTPS requests — now carries Chrome 150's signature algorithms, which lead
  with the ML-DSA codepoints. Its TLS fingerprint matches current Chrome again, instead of
  Chrome 135-149. #2090

Fixed

• Treat <textarea> as an escapable raw text element: tags inside it (e.g. a
  <script> string being the first "script tag" in the document) are no longer
  parsed as real markup, so the AdGuard content script is not injected into it.
• Fixed an off-by-one in the closing-tag start index of skip-content
  elements (style, noscript, textarea): end_tag_start_idx now points at
  the < of the closing tag, matching the normal tag-parsing path.
• [Android] Fixed a crash on a CONNECT request inside a filtered HTTP/2 or HTTP/3 connection.
  The application is notified of such a tunnel through ProxyServerListener.onNewConnection, but
  its answer is dropped: new connections are reported asynchronously on Android, and the tunnel is
  opened without waiting and filtered according to the current settings.