fix(fetch): Shallow-clone fetch options to prevent mutation

[s1gr1d]

When injecting tracing headers into fetch requests, the SDK was mutating the user's original options object. This caused issues when users reused config objects across requests or when the object was frozen (e.g., from Immer's produce()), leading to silent failures. This change shallow clones the options object before modifying it, ensuring the original remains unchanged while still properly injecting the sentry-trace and baggage headers.

Closes #18828

[github-actions]

size-limit report 📦

Path	Size	% Change	Change
@sentry/browser	25.11 kB	-	-
@sentry/browser - with treeshaking flags	23.61 kB	-	-
@sentry/browser (incl. Tracing)	41.87 kB	+0.02%	+5 B 🔺
@sentry/browser (incl. Tracing, Profiling)	46.45 kB	+0.02%	+5 B 🔺
@sentry/browser (incl. Tracing, Replay)	80.47 kB	+0.01%	+6 B 🔺
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags	70.16 kB	+0.01%	+6 B 🔺
@sentry/browser (incl. Tracing, Replay with Canvas)	85.17 kB	+0.01%	+7 B 🔺
@sentry/browser (incl. Tracing, Replay, Feedback)	97.37 kB	+0.01%	+6 B 🔺
@sentry/browser (incl. Feedback)	41.83 kB	-	-
@sentry/browser (incl. sendFeedback)	29.79 kB	-	-
@sentry/browser (incl. FeedbackAsync)	34.79 kB	-	-
@sentry/browser (incl. Metrics)	26.21 kB	-	-
@sentry/browser (incl. Logs)	26.37 kB	-	-
@sentry/browser (incl. Metrics & Logs)	27.02 kB	-	-
@sentry/react	26.84 kB	-	-
@sentry/react (incl. Tracing)	44.09 kB	+0.02%	+5 B 🔺
@sentry/vue	29.56 kB	-	-
@sentry/vue (incl. Tracing)	43.67 kB	+0.01%	+2 B 🔺
@sentry/svelte	25.12 kB	-	-
CDN Bundle	27.67 kB	-	-
CDN Bundle (incl. Tracing)	42.67 kB	+0.01%	+1 B 🔺
CDN Bundle (incl. Tracing, Logs, Metrics)	43.5 kB	+0.01%	+1 B 🔺
CDN Bundle (incl. Tracing, Replay)	79.37 kB	+0.01%	+1 B 🔺
CDN Bundle (incl. Tracing, Replay, Feedback)	84.81 kB	+0.01%	+6 B 🔺
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)	85.72 kB	+0.01%	+3 B 🔺
CDN Bundle - uncompressed	81.08 kB	-	-
CDN Bundle (incl. Tracing) - uncompressed	126.5 kB	+0.01%	+5 B 🔺
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed	129.33 kB	+0.01%	+5 B 🔺
CDN Bundle (incl. Tracing, Replay) - uncompressed	243.03 kB	+0.01%	+5 B 🔺
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	255.83 kB	+0.01%	+5 B 🔺
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed	258.64 kB	+0.01%	+5 B 🔺
@sentry/nextjs (client)	46.44 kB	+0.02%	+6 B 🔺
@sentry/sveltekit (client)	42.25 kB	+0.02%	+5 B 🔺
@sentry/node-core	51.91 kB	-	-
@sentry/node	162.16 kB	-	-
@sentry/node - without tracing	93.33 kB	+0.01%	+1 B 🔺
@sentry/aws-serverless	108.83 kB	-0.01%	-1 B 🔽

View base workflow run

[github-actions]

node-overhead report 🧳

Note: This is a synthetic benchmark with a minimal express app and does not necessarily reflect the real-world performance impact in an application.

Scenario	Requests/s	% of Baseline	Prev. Requests/s	Change %
GET Baseline	8,933	-	8,622	+4%
GET With Sentry	1,725	19%	1,527	+13%
GET With Sentry (error only)	6,011	67%	5,647	+6%
POST Baseline	1,201	-	1,124	+7%
POST With Sentry	588	49%	546	+8%
POST With Sentry (error only)	1,059	88%	974	+9%
MYSQL Baseline	3,301	-	3,114	+6%
MYSQL With Sentry	476	14%	379	+26%
MYSQL With Sentry (error only)	2,738	83%	2,518	+9%

View base workflow run

[andreiborza]

Thanks for taking care of this 🙏