Add session-scoped request history browser

[Alistar84]

Hello!

• Type: new feature
• Link to issue: Support for browsing previous requests (request history / multi-request navigation) #21

In raising this pull request, I confirm the following:

• I have read and understood the Contributing Guidelines
• I have checked that another pull request for this purpose does not exist
• I wrote tests for this PR
• I have updated the relevant CHANGELOG
• I have created a separate PR for the documentation (the documentation is included in this PR)

Small description of change:

This PR adds an optional, session-scoped request history system to the debug bar.

It resolves #21, which describes the current limitation where the bar can only inspect the request that rendered the current page. This makes completed AJAX requests, redirects, and earlier requests difficult to inspect once they have finished.

Closes #21.

When enabled, the new history system records the collected debug-bar payload together with request metadata such as:

• HTTP method
• URI
• response status
• AJAX flag
• request timestamp

A new History item in the bottom bar opens the list of stored requests. Selecting a request replaces the currently displayed collector data without navigating away from or reloading the host page. The history browser also provides refresh and clear controls.

Storage and retention

History storage is disabled by default and must be enabled explicitly through configuration.

Stored requests are:

• isolated by a SHA-256 hash of the active PHP session ID
• written atomically to a configurable filesystem directory
• limited by a configurable maximum request count
• automatically removed after a configurable TTL
• not recorded or exposed when no PHP session is active

The storage path defaults to the system temporary directory and can be configured outside the application document root.

Internal endpoint

When history is enabled, the provider automatically registers an internal controller for:

• GET /_debugbar/open - list stored request metadata
• GET /_debugbar/open?id=<request-id> - load a stored debug-bar payload
• DELETE /_debugbar/open - clear the current session's history

The endpoint reuses the debug bar access gate, returns private non-cacheable responses, validates request IDs, and excludes its own requests from the history.

Backward compatibility

The feature is opt-in. Existing applications retain the current behavior when history.enabled is not enabled.

Tests

The PR includes tests covering:

• session isolation
• filesystem persistence
• maximum request pruning
• TTL expiration
• request lookup and validation
• clearing stored requests
• the internal controller
• provider route registration
• the history collector

Thanks

[niden]

@Alistar84 At some point please rebase from master. I put a fix in for the warning emitted in the CI that makes this CI red. Thanks

[Alistar84]

Rebased onto the latest master. Thanks for the fix!