fix: Validate privateAttributes in OpenFeature context conversion

[kinyoklion]

The JavaScript OpenFeature providers now validate the privateAttributes evaluation context attribute instead of forwarding it unchecked.

• A privateAttributes value which is not an array is dropped and an error is logged
• Non-string entries within the array are dropped and an error is logged
• _meta is only added to the converted context when at least one private attribute survives

Requirements

• I have added test coverage for new or changed functionality
• I have followed the repository's pull request submission guidelines
• I have validated my changes against all supported platform versions

Related issues

None.

Describe the solution you've provided

translateContext assigned _meta.privateAttributes with a value as string[] cast, so an application which set privateAttributes to a string (or to an array containing non-strings) produced a context whose private attribute list was not a list of strings. The behavior spec (OFP 2.4.4, 2.4.5, 2.4.5.1) requires the attribute to be dropped with an error in that case, which is what the Java, Python, Ruby and PHP providers already do.

Dropping the bad value is the safer of the two options here, since a malformed private attribute list can otherwise be silently ignored further down and result in attributes being sent to LaunchDarkly which the application intended to keep private.

Describe alternatives you've considered

Coercing entries to strings was rejected: private attribute names are references into the context, so a coerced name would not match any attribute and would give a false sense of privacy.

Additional context

Found during the weekly OpenFeature provider audit. The key/targetingKey validation gap in the same function is handled in a separate PR.

Link to Devin session: https://app.devin.ai/sessions/9f0be899af7842e0b6a7bfc6229084f6
Open in Devin Desktop: https://app.devin.ai/desktop/session/9f0be899af7842e0b6a7bfc6229084f6?variant=devin
Requested by: @kinyoklion

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

@cursor review

[github-actions]

@launchdarkly/js-client-sdk size report
This is the brotli compressed size of the ESM build.
Compressed size: 32563 bytes
Compressed size limit: 34000
Uncompressed size: 116654 bytes

[github-actions]

@launchdarkly/js-sdk-common size report
This is the brotli compressed size of the ESM build.
Compressed size: 26360 bytes
Compressed size limit: 29000
Uncompressed size: 129188 bytes

[github-actions]

@launchdarkly/browser size report
This is the brotli compressed size of the ESM build.
Compressed size: 180110 bytes
Compressed size limit: 200000
Uncompressed size: 833835 bytes

[github-actions]

@launchdarkly/js-client-sdk-common size report
This is the brotli compressed size of the ESM build.
Compressed size: 25571 bytes
Compressed size limit: 44000
Uncompressed size: 166117 bytes