Add config.js_exclude_paths to skip rollbar.js injection on some paths

[bugthing]

Rollbar::Middleware::Js currently injects the rollbar.js snippet into every 200 HTML response app-wide, with no way to opt individual paths out.

The poblem is for routes that serve their own restrictive Content-Security-Policy, for example rswag-ui's Swagger UI page sets a hardcoded, narrow CSP (script-src 'self' 'unsafe-inline') that doesn't allow cdn.rollbar.com. The injected snippet's breaks their CSP

Change

Adds config.js_exclude_paths, an array of String (matched as a PATH_INFO prefix) or Regexp entries. When a request's path matches any entry, Rollbar::Middleware::Js skips injecting the config/snippet <script> tags for that response, using the same short-circuit as the existing enabled?/attachment?/streaming? checks in add_js?.

Rollbar.configure do |config|
  config.js_enabled = true
  config.js_exclude_paths = ['/api-docs', %r{\A/health}]
end

Defaults to [], so this is fully backward compatible — no behavior change unless the option is explicitly set.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8fbb3c1948

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".