inject request inspector JS at document start to fix race condition

[maxeoneo]

The fetch interceptor was injected via evaluateJavascript() inside onPageStarted(), which queues the script asynchronously on the WebView JS thread. Because the bundled webapp is served synchronously from local assets (no network latency), it could execute and make API fetch calls before the injection ran. This meant window.fetch was not yet overridden: no UUID header was injected, recordFetch() was never called, and shouldInterceptRequest() could not match the recorded request — resulting in an empty request body being proxied.

We could fix it by using WebViewCompat.addDocumentStartJavaScript(), registered once at WebView init time. This API guarantees the script runs at document creation before any page scripts execute, eliminating the race condition. The solution falls back to the evaluateJavascript approach on WebView versions that do not support DOCUMENT_START_SCRIPT.

Another race condition for the GeneratedUuidInHeaderRequestMatcher is, that before the first request of the webapp is done, the origin needs to be set. Since onPageStarted is executed asynchronously, it could still happen that it is executed after the first request. That would lead to the additional header being not set, because the matcher believes to deal with a CORS request. So the fix is to check the request for isMainFrame, indicating that the webapp itself gets loaded and set the origin there.

This change also makes sure that the origin is set within "onLoadMainFrame", because it is called when the webapp itself is loaded. This leads to the origin being set before the first request of the webapp can be done.