MediaWiki is logging IP and user agent for security-sensitive events (such as login attempts) in Logstash. This is not that useful today - it's common that an attacker is rotating through many IPs and fake browser UAs, and we can easily sample the attack (because some aspect of it causes a big spike) but we'd want to identify all the requests (because there might be other aspects of it) and with just IP/UA that can be hard.
The CDN keeps track of less obvious / harder to game information about clients via the backend API headers and JA3N/JA4H hashes, and it would be useful to have those in Logstash (assuming there are no privacy concerns). That would require 1) passing the relevant headers through to MediaWiki, 2) adding them to the security log context (T395204).
Sending these headers from the CDN is something we'd probably want to do anyway for the API gateway.
Acceptance criteria
- x_is_browser_likely_script and x_is_browser_likely_browser are logged via at least WebRequest::getSecurityLogContext(), if not on all logs