feat: add script to automate updating bugsnag api client

[sazap10]

Goal

Automate the previously manual process for updating the Bugsnag API client.

Design

The Bugsnag API client (src/bugsnag/client/api/api.ts) is generated from SwaggerHub but requires significant manual post-processing (removing duplicate imports, pruning object-oriented wrappers/factories we don't use, removing unused API exports, etc.).

This PR introduces an automated Node.js script (scripts/update-bugsnag-api.ts) using ts-morph and the Swagger generator API to automate the end-to-end process.
The new workflow is simply running npm run update:bugsnag-api.

This script handles:

1. Fetching the latest swagger.json directly from SmartBear's public API.
2. Generating the base typescript-fetch client via the Swagger Generator API.
3. Injecting our custom linting overrides and node:url imports.
4. Parsing the AST via ts-morph to reliably delete object-oriented API classes, factories, FPs, and generic fetch APIs that aren't necessary.
5. Evaluating export references dynamically to un-export types not consumed outside the file, preventing unused export warnings in the wider project.
6. Automatically formatting the result via npx biome check --write --unsafe.
7. Passing the modified file through the project's prek pre-commit hooks.

Changeset

• Added scripts/update-bugsnag-api.ts to orchestrate AST manipulation and network requests.
• Added "update:bugsnag-api" to package.json scripts.
• Updated src/bugsnag/client/api/api.ts header comments to document the new 2-step process.
• Updated the actual client code inside api.ts which has been generated and heavily trimmed by the new script, bringing it to the latest version of the spec.

Testing

Ran npm run update:bugsnag-api which successfully generated the new code, applied all AST transformations, stripped unused exports, formatted with biome, and passed prek checks.
Ran npm run test:run and confirmed all 894 unit tests continue to pass.

In general, the safest fix is to avoid constructing shell command strings from untrusted input and instead use child_process APIs that accept the command and its arguments as separate parameters without invoking a shell (execFileSync, spawnSync, etc.). This prevents shell metacharacters in the input from being interpreted as part of the command.

For this specific case, we should replace the execSync curl invocation with a call to execFileSync (from the same child_process module) and pass link and zipPath as separate arguments. That preserves existing behavior (still calling curl -s <link> -o <zipPath>) but no longer runs through a shell, so link is only ever treated as a single argument. Concretely, in scripts/update-bugsnag-api.ts around line 68, change:

• execSync(\curl -s "${link}" -o ${zipPath}`);`

to:

• execFileSync("curl", ["-s", link, "-o", zipPath]);

We also need to import execFileSync from child_process alongside the existing execSync import at the top of the same file. No other logic or files need to be changed.