fix: prevent generated pwa icons to be added to manifest (#20639) (#2…

…0650)

Generated PWA icons are served at runtime by PwaHandler, that also takes care
of adding a subset of them to the web manifest for caching.
However, the Vite inject-manifest-to-sw plugin adds all generated icons to the
manifest with /pwa-icons path prefix making them pre-cached by the browser and
potentially breaking pre-defined security rules.
This change prevents generated icons to be added to the manifest, preserving
the previous behavior.

Co-authored-by: Marco Collovati <marco@vaadin.com>

flow-server/src/main/resources/vite.generated.ts

@@ -106,7 +106,7 @@ function injectManifestToSWPlugin(): rollup.Plugin {
         const { manifestEntries } = await getManifest({
           globDirectory: buildOutputFolder,
           globPatterns: ['**/*'],
-          globIgnores: ['**/*.br'],
+          globIgnores: ['**/*.br', 'pwa-icons/**'],
           manifestTransforms: [rewriteManifestIndexHtmlUrl],
           maximumFileSizeToCacheInBytes: 100 * 1024 * 1024 // 100mb,
         });