feat: add camoufox support default for potoken generation - #360

Checklist

• I have read the AI Policy and understand the disclosure requirements

AI Disclosure

• AI was not used to create this pull request
• AI was used to fully create this pull request
• AI was used to partially create this pull request

Model(s) used (and thinking/reasoning level if relevant):
GPT 5.6 Sol (Max) + Claude Opus 4.8

Tool(s) used:
Opencode and Claude code

How was AI used?

GPT 5.6 Sol was used to fully write the code. And Claude Opus 4.8 reviewed the code and improved it.

Pull request description

While working on iv-org/invidious#5814, I found that a potoken generated by jsdom doesn't work. It needs to be generated from a real browser environment.

I have evaluated a lot of headless browsers:

• patchright: Required headless=false with xfvb. Not a good candidate because xfvb can be unstable.
• https://github.com/yfedoseev/browser_oxide: Doesn't have native integration for NodeJS so skipped.
• https://github.com/h4ckf0r0day/obscura: Could be a valid candidate but has some issues with awaitpromise when using CDP, issue opened v0.1.11: Runtime.evaluate awaitPromise returns null for resolved Promises h4ckf0r0day/obscura#541
• https://github.com/lightpanda-io/browser: Doesn't provide a valid potoken

I implemented camoufox because it doesn't require a virtual display, lower on memory usage than chromium and has very good stealth capabilities.

The code is implemented in a way that allows to swap to any other browser that support CDP protocol. In case we want to switch to a more lightweight one.

I don't fully like it but camoufox introduced a lot of requirements and was hard to package for docker + deno compile. It's the best candidate as of right now but I hope I'll be able to replace it with either oxide or obscura in the future.

This new potoken generation may allow being less blocked by YouTube.

So this PR adds a new potoken generation for the current way of fetching videoplayback URLs for DASH but will be mandatory for SABR usage.

Features

• Camoufox already built into the Docker image
• Renovate will create pull requests for new camoufox versions.
• bgutils is not used anymore, its behavior is entirely reproduced in attestation.ts. It's similar to what PipePipe do: https://github.com/InfinityLoop1308/PipePipeClient/blob/488c74340ddd846f67e1ee1c1b6694f23e2b0c33/app/src/main/assets/sabr_po_token.js#L110
• If camoufox can't be downloaded or ran, invidious companion will fallback to jsdom.