feat: ATS certificate pinning narrow down on iOS

[alexruzenhack]

Motivation

The default network security provided by ATS on iOS is broad, and this PR narrows it down to anchor and pinned certificates.

Description

React Native makes use of the iOS network framework in its own way. A possible entry point to hook network events and intercept a connection lay on the RCTHTTPRequestHandler class, which is a category of NSURLSessionDataDelegate, therefore responsible to intercept request events and add logic over it. The React Native implementation of the data delegate doesn't implement the authentication challenge and relies on the default behavior provided by ATS. This fact turns our job easier because we don't need to worry about likely side effects.

Acceptance Criteria

• Extends RCTHTTPRequestHandler to handle the authentication challenge event on session scope
• Validates anchor certificate prior the hostname filter
• Filter connections to allow only pinned domains using the ATS settings
• Rely on session identity cache provided by ATS to improve performance on requests
• Conduct certificate evaluation for the allowed domains using ATS
• Cancel the connection if the TLS handshake fail to match the anchor certificate
• Cancel the connection if the host domain is not allowed
• Cancel the connection if the certificate is not trust worthy
• Crashes the application if the ATS settings is not valid

Note

I'm providing an ATS configuration alongside with Android's network configuration used during the tests, but this should change in a further PR with the proper certificate configuration when the certificates are issued.

Security Checklist

• Make sure you do not include new dependencies in the project unless strictly necessary and do not include dev-dependencies as production ones. More dependencies increase the possibility of one of them being hijacked and affecting us.

[andreabadesso]

What about the explorer URLs?

[andreabadesso]

And tx mining service