Security/privacy considerations around did:onion

[clehner]

As mentioned in #147:

Security considerations around use in browsers: should some safety be placed around this resolver in WASM usage? In non-WASM, the default is to use proxy 127.0.0.1:9050, but in the browser there is no such assumption - we just fire off a Fetch reqwest.

[sbihel]

My understanding from the Fetch specs is that it's forbidden to set a proxy at the request level -- it's only possible to set it in the browser settings.

These are forbidden so the user agent remains in full control over them.

I'm not sure what we can do about it -- maybe make a dummy request and have a look at the proxy headers in the response (if that's even set)? Or just put a note in the docs.