security: comprehensive security hardening for API keys, TLS, and data privacy

[Littleyd]

Summary

This PR addresses multiple security vulnerabilities identified during a comprehensive security audit of the Easydict codebase. The changes focus on protecting user data and API credentials.

High-Priority Fixes

1. API Keys migrated to macOS Keychain — All translation service API keys/secrets (DeepL, Baidu, Ali, Tencent, Volcano, NiuTrans, Caiyun, and OpenAI-compatible stream services) are now stored in Keychain instead of UserDefaults. A transparent migration runs on first launch.

2. WebView TLS certificate validation restored — Removed allowsAnyHTTPSCertificateForHost:YES and the blanket trust in didReceiveAuthenticationChallenge:. WebView now properly validates server certificates.

3. App Transport Security tightened — Replaced NSAllowsArbitraryLoads = YES with NSAllowsLocalNetworking = YES in both Info.plist and Info-debug.plist, restricting plaintext HTTP to localhost only.

4. Hardcoded Baidu session cookie removed — Removed embedded BDUSS/BDUSS_BFESS values from EZWebViewTranslator.m.

5. URL Scheme key read/write gated by user confirmation — easydict://writeKeyValue and easydict://readValueOfKey now show an NSAlert requiring explicit user approval before executing.

Medium-Priority Fixes

6. Analytics & crash reporting default to opt-in — allowCrashLog and allowAnalytics now default to false.

7. OCR text truncated in logs — Full OCR results are no longer written to system logs.

8. Sensitive keys filtered from backup export — API keys, secrets, and tokens are excluded from the user data export file.

9. Bing endpoint upgraded to HTTPS — Changed http:// to https:// for the Bing China host.

New Files

• Easydict/Swift/Utility/KeychainHelper.swift — Keychain CRUD helper + migration logic from UserDefaults to Keychain.

Test Plan

• Fresh install: verify no crash on first launch (migration runs with empty UserDefaults)
• Upgrade from existing install: verify API keys are migrated to Keychain and removed from UserDefaults
• Translation services (DeepL, Baidu, Tencent, Ali, Volcano, NiuTrans, Caiyun, OpenAI): verify keys are read from Keychain and services function normally
• WebView-based translators (Google, Bing, Baidu web): verify pages load correctly with restored TLS validation
• URL Scheme: test easydict://writeKeyValue?EZTest=abc shows confirmation dialog
• URL Scheme: test easydict://readValueOfKey?EZTest shows confirmation dialog
• Settings → Service config: enter a new API key, close settings, verify key persists (synced to Keychain)
• Backup export: verify exported file does not contain API keys or tokens
• Analytics: verify Firebase/Sentry are disabled by default on fresh install

Made with Cursor

[github-actions]

Hello Littleyd, Thank you for your first PR contribution 🎉 Littleyd

[tisfeng]

Please use dev branch as base branch