fix(core): redact deep-link query params before sending as event properties…

[sunitaprajapati89]

Summary
Problem: When trackDeepLinks is enabled, the full deep-link URL (including query string) was spread into the Deep Link Opened event and uploaded. Deep links routinely carry secrets — OAuth authorization codes, magic-link/password-reset tokens, session IDs — that should never appear in analytics data.
On Android, individual query params were additionally spread as top-level event properties (e.g. token, code) alongside the raw URL.
Changes
util.ts — adds stripQueryString(url) helper that removes everything from ? onward, keeping scheme, host, and path.
analytics.ts — trackDeepLinkEvent now strips the query string from url by default before building the event. A new deepLinkPropertiesDecorator config hook lets callers override this (e.g. to allowlist safe params like utm_source while dropping secrets).
types.ts — adds deepLinkPropertiesDecorator?: (props) => props to Config with a doc comment explaining the risk.
AnalyticsReactNativeModule.kt — replaces the query-param spread loop with uri.buildUpon().clearQuery().fragment(null), stripping secrets at the native layer before they reach JS.
Test plan
stripQueryString unit tests: no query string (unchanged), single param stripped, multiple params stripped, no-path URL
trackDeepLinks integration tests: default stripping removes query string from URL; deepLinkPropertiesDecorator is called with original props and its return value is used
Existing deep-link tests still pass (URLs without query strings are unaffected)
Run yarn test in packages/core — all tests pass

Migration note
If you rely on query parameters being present in Deep Link Opened events, use deepLinkPropertiesDecorator to selectively re-add the ones you need:

createClient({
  writeKey: '...',
  trackDeepLinks: true,
  deepLinkPropertiesDecorator: ({ url, referring_application }) => {
    const params = new URL(url.replace('myapp://', 'https://placeholder/'));
    return {
      url: `myapp://${params.pathname}`,
      referring_application,
      utm_source: params.searchParams.get('utm_source') ?? undefined,
    };
  },
});