fix: prevent 500s from malformed requests in crumb generation

[mokhld]

Summary of Attempted Solutions That Didn't Work:

1. Yar Configuration

   • Tried enabling storeBlank: true in session plugin
   • Didn't resolve the state initialisation timing issue and there's the issue of it breaking our auth tests mentioned in the comment

2. Crumb Plugin Changes

   • Added skip function with state checks
   • Added try/catch and defensive checks
   • Still hit errors before skip function was called

Root Issue:
The error occurs because crumb tries to access request.state before Yar has a chance to initialise it

[mokhld]

I attempted to mark as optional in Hapi type definitions but it can't seem be overridden, and can be undefined for malformed requests hence the 500s (see here)

[mokhld]

We could also make this more defensive if needed but it's scalability is questionable e.g.

 request?.state &&
!request.path.includes('//')

[sonarqubecloud]

Quality Gate failed

Failed conditions
84.6% Coverage on New Code (required ≥ 90%)

See analysis details on SonarQube Cloud

[alexluckett]

Thank you 🙌