locator: sign control plane requests

[lynnagara]

to match hmac auth added in getsentry/sentry#105975

[markstory]

Looking good so far.

[sentry]

Bug: The HMAC signature is computed using url.path(), which excludes query parameters. This will cause signature validation to fail for paginated requests that include a cursor parameter.
_{Severity: CRITICAL}

Suggested Fix

The HMAC signature should be computed over the full request path including the query string. Instead of just url.path(), use a combination of the path and url.query() to construct the data to be signed. This ensures that the client and server are signing the exact same request components.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: locator/src/control_plane.rs#L169

Potential issue: The HMAC signature for control plane requests is calculated on line 169
using `url.path()`. However, this method from the `url` crate returns only the path
component, excluding any query parameters. For paginated requests, a `cursor` query
parameter is added to the URL. When the server receives the request, it will compute the
signature over the full path and query string, leading to a mismatch and a validation
failure. This will break the locator service's ability to sync multi-page snapshots or
incremental updates whenever pagination is required.

_{Did we get this right? 👍 / 👎 to inform future reviews.}

[markstory]

The validation side in django doesn't include the query string either.

[markstory]

The validation side in django doesn't include the query string either.