Pin playground to v1.7.28 and add polyfill for mutation events

[Shane32]

Apparently 'mutation events' like DOMNodeRemoved were removed from Chrome this past July. Meanwhile, Playground hasn't had an update in years. This PR adds a polyfill for the removed functionality so that the obsolete Playground UI will continue to function.

In addition, I added subresource integrity hashes to the scripts. This is to prevent users from becoming susceptible to hackers if the CDN is compromised, such as occurred recently in this news article:

• Polyfill.io Attack Impacts Over 380,000 Hosts, Including Major Companies

Browsers will reject the script if it doesn't match the SHA-384 hash embedded in our html page, preventing compromise of their server.

Since all scripts now have their content checked to match a predetermined hash, the exact version of the npm package was added to the links. Otherwise, if a newer version is released, Playground would not load since the hash would not match.

Closes:

• GraphQL.Server.Ui.Playground autoComplete or Type Box doesn't disappear #1158

See:

• https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity
• https://developer.chrome.com/blog/mutation-events-deprecation
• https://github.com/mfreed7/mutation-events-polyfill#readme
• https://www.npmjs.com/package/mutation-events

[gao-artur]

I don't really understand what you did here but OK 🙂

[Shane32]

@gao-artur I updated the PR description to more fully explain the changes.

[gao-artur]

@Shane32 I think this PR broke the autocomplete in the Playground.

[Shane32]

Well, it's not working properly now, but I must say, I think it was working even worse without this PR. What do you propose? Playground isn't supported and hasn't had a release in 5 years. I'm not really interesting in investing time figuring out how to patch the javascript code. My best suggestion is to mark all members as obsolete and release one final version, after which we remove the package from the solution. I had hoped that by introducing the polyfill, it would start working properly again. But it does not appear to have solved all the problems.

[gao-artur]

I'm fine with that. We will probably stop using it soon.