docs: add danger note to auth guide

[rwoll]

No description provided.

[mxschmitt]

Suggested change

	We strongly discourage checking them into private or public repositories.
	We strongly discourage checking them into private or public repositories and adding it to your `.gitignore` file.

[dgozman]

I would love the auth guide to not have a BIG RED WARNING on the first page!

[rwoll]

It's big red warning worthy, IMO. I don't suggest it lightly and do appreciate not wanting to decorate the docs with a bunch of warnings. However, the consequence of checking these auth files in under many circumstances is full account takeover, and there's evidence many folks are not aware of the risks of checking these in.

That being said, perhaps there's something we could implement to make it safe(r)-by-default.

Some alternative ideas I had (with various degrees of effectiveness vs. implementationd difficulty vs. DX):

1. Add playwright/.auth to the Create Playwright template, and hope folks heed the recommendation to put this files in the .auth/ directory.

2. Have some sort of explicit safelist for headers that the user could configure with everything off-by-default if — and only if — playwright detects the file is not in .gitignore.

3. Provide users a specific API for marking sensitive state files and ensure PW puts them in a location outside the tree¹:

   {
     name: 'firefox',
     use: {
       ...devices['Desktop Firefox'],
       // Use prepared auth state.
       storageState: { sensitive: true, 'playwright/.auth/user.json' },
     },
     dependencies: ['setup'],
   },
   

¹: It's important they are put outside the working directory/tree since some folks will decide to by default upload the entire plawright/* directory as a build artifact and it would be bad if these files were slurped up into it.

wdyt? My vote would be something like #3.

[rwoll]

@dgozman - or perhaps it could be as simple as:

1. Do not add the big red warning,
2. But update the example docs to have the user store the files in a temp dir:

    {
      name: 'firefox',
      use: {
        ...devices['Desktop Firefox'],
        // Use prepared auth state.
        storageState: `${mkdirtemp()}/playwright/.auth/user.json`,
      },
      dependencies: ['setup'],
    },
  ],