Split exclusion settings

Today, one setting used to hold both your own exclusions and the static-file extensions.
It is now two settings with one job each:

What to do on upgrade

• You never set a custom exclusion → nothing to do. The standard list applies automatically.
• You set a custom exclusion → remove the static-file patterns from it and keep
  only your own URLs. The extensions are handled by the new setting.

- DATADOME_URL_REGEX_EXCLUSION="/health|/heartbeat|\.(css|js|png|jpg|svg|woff2|ico)$"
+ DATADOME_URL_REGEX_EXCLUSION="/health|/heartbeat"

Additional URI checks enabled by default

This release introduces two URI checks that are enabled by default. They affect how DataDome normalizes and evaluates URLs before applying exclusion rules. Review each setting and disable it only if necessary for compatibility with your application.

1. Matrix parameters (;…) are ignored before matching

DATADOME_REMOVE_MATRIX_PARAMS : default: on

A URL path may carry parameters after a ; (for example ;jsessionid=…). Some frameworks ignore them when routing, so DataDome now ignores them before matching the extension, exactly as query parameters after ? are already ignored.

Removal stops at the next /, and only ; is affected.

Set it to off to keep the previous behavior.

2. Encoded characters cancel the static-asset skip

DATADOME_ENCODED_CHAR_INCLUSION : regex, default: on (%23 %25 %2f %3b %3f)

Some encoded characters are delimiters that your origin decodes and routes on, while
the module only sees a clean .zip or .js ending. When a path looks like a static
file and contains one of these encoded delimiters, DataDome inspects it instead
of skipping it.

Uppercase and lowercase hex are both matched (%2F and %2f).

Set to "" to keep the previous behavior.