feat: AJAX uses token authentication

[dcalhoun]

Related:

• 192611-ghe-Automattic/wpcom
• 192792-ghe-Automattic/wpcom
• feat: Expand application password abilities Automattic/jetpack#45220
• refactor: VideoPress utilizes the @wordpress/api-fetch utility Automattic/jetpack#45254
• feat: Editor assets endpoint allows the VideoPress block Automattic/jetpack#45255
• feat: Allow Android WebView admin-ajax.php CORS requests Automattic/jetpack#45292

What?

Authenticate AJAX requests with application passwords send via an authorization
header.

Why?

The GutenbergKit editor does not have authorization cookies, so we must rely
upon a different authorization mechanism.

Ref CMM-713. Close CMM-768.

How?

Set the Authorization header via jQuery.ajaxSetup and by overloading the
window.wp.ajax utilities.

Testing Instructions

Tip

Test using prototype builds from the sibling PRs:

• chore: Test GutenbergKit VideoPress WordPress-Android#22229 (comment)
• chore: Test GutenbergKit VideoPress WordPress-iOS#24887 (comment)

Note

Selecting media from cloud-based storage providers on Android often fails due to a Chrome bug (CMM-782); use the Browse... menu to select local files.

1. Apply the required Jetpack changes and WPCOM (192792-ghe-Automattic/wpcom) changes to your site.
2. Proxy your test device's networking through to your modified WPCOM in step 1.
3. Open the experimental block editor in the Jetpack mobile app for Android.
4. Insert a VideoPress block.
5. Attach media.
6. Verify the upload succeeds.

Accessibility Testing Instructions

N/A, no navigation changes.

Screenshots or screencast

N/A, no visual changes.