Refactor websocket code to $oh namespace & Pass access token through header

[florian-h05]

Depens on openhab/openhab-core#4515.

This refactors the WebSocket connection code from #2884 to the $oh namespace, same as it is for the SSE logic.
It also passes the access token as WebSocket subprotocol so it is sent with the Sec-WebSocket-Protocol header.

[florian-h05]

@ghys This refactors the WS to the $oh namespace.
Let's postpone merging this after the release to not impose any risks.

[relativeci]

#2582 Bundle Size — 10.9MiB (~+0.01%).

d5203ea(current) vs 0ead7b8 main#2579(baseline)

Warning

Bundle contains 2 duplicate packages – View duplicate packages

Bundle metrics   3 changes 1 regression

	Current #2582	Baseline #2579
Initial JS	1.92MiB(+0.08%)	1.92MiB
Initial CSS	577.83KiB	577.83KiB
Cache Invalidation	17.65%	17.58%
Chunks	226	226
Assets	249	249
Modules	2948(+0.03%)	2947
Duplicate Modules	152	152
Duplicate Code	1.8%	1.8%
Packages	96	96
Duplicate Packages	2	2

Bundle size by type   1 change 1 regression

	Current #2582	Baseline #2579
JS	9.11MiB (+0.01%)	9.11MiB
CSS	866.74KiB	866.74KiB
Fonts	526.1KiB	526.1KiB
Media	295.6KiB	295.6KiB
IMG	140.74KiB	140.74KiB
HTML	1.38KiB	1.38KiB
Other	871B	871B

Bundle analysis report Branch florian-h05:ws-rfc Project dashboard

---

^{Generated by RelativeCI Documentation Report issue}

[florian-h05]

@ghys Can you please have a look at this PR?

[ghys]

It's good but I'd still prefer the access token to be passed in headers instead of the URL query: openhab/openhab-core#4490
(at least when possible)

This reduces the odds that it could appear in a log.
Even if ephemeral, tokens should never be logged.

If it's urgent please merge but otherwise I don't see why the rush.

[florian-h05]

@ghys I have created a PR to address openhab/openhab-core#4490 and adjusted this PR here.

[ghys]

Excellent, thanks!

[cdjackson]

@florian-h05 is it possible to provide backward compatibility with the old url parameter based authentication so we can continue to run this on OH4 for a while? I've got an OH5 test system which is fine for testing UI, but it would really be nice for now if we can also proxy this across to a live OH4.x system, and currently that doesn't work after this change.

I tried adding the parameter back (so putting the token in both the header and parameter) and that didn't work - I had to remove the header to make it work on OH4.

I think it would be good to keep compatibility for testing for a little while at least if possible?