Evaluate current parsing error strategy

[cvazac]

During code review here, Mike West said:

Right now, you're setting duration_ to zero if someone passes in duration=whatever. Did you consider something a little more draconian? Reject the header entirely, perhaps, with an appropriate console warning for non-numeric values?

I responded:

At present, this header resolves to a duration of 0.0:
name; duration=foo; duration=123

I think that holds up, spec-wise, so my preference would be to leave as-is.
-first specified parameter "wins" (others are ignored)
(https://w3c.github.io/server-timing/#the-server-timing-header-field)
-failure to parse a duration as a double should result in 0.0.
https://w3c.github.io/server-timing/#-dfn-server-timing-header-parsing-algorithm-dfn-

It is worth having a discussion about how draconian we should be with regard to parse errors.

[yoavweiss]

@mikewest any security-related reasons we want to change paring to be more draconian?

[toddreifsteck]

Rough summary of discussion at TPAC 2018:

• @cvazac will find data on whether Chrome is parsing data that is not "per spec" in the wild. If it is, we can't break and will need to update spec and file bug on Firefox to fix to new spec update.
• If it isn't parsing data that breaks spec, we should file bugs on Safari/Chrome to update this behavior to pass the tests

[ddragana]

Rough summary of discussion at TPAC 2018:

* @cvazac will find data on whether Chrome is parsing data that is not "per spec" in the wild. If it is, we can't break and will need to update spec and file bug on Firefox to fix to new spec update.

* If it isn't parsing data that breaks spec, we should file bugs on Safari/Chrome to update this behavior to pass the tests

The decision is fine by me. (We will update Firefox if needed)

[cvazac]

Current plan as discussed with @yoavweiss:
I'm going to use BQ on HA to identify server-timing header values that we currently parse, but in the future we might want to not allow.

Example:

Server-Timing: metric==   ""foo;dur=123.4

Firefox/spec say the duration should be 123.4. Chrome/Safari stop their processing when it finds the extra chars before the ;, leaving the duration as 0.

[noamr]

See #87
This is all covered in WPT