fix(levelplay): recommend scoped ATS exceptions only, never NSAllowsArbitraryLoads

[ziyiunity]

What

The iOS setup guide offered NSAllowsArbitraryLoads = true as "Option 1 (easiest)" for getting ads to load. That key turns off App Transport Security for every connection the app makes, including its own backend and login traffic, not just ad traffic, and App Review commonly rejects it. A developer or an agent following the guide would copy it into a shipping app.

Change

• The guide now says no ATS configuration is needed: with ATS at the iOS default, the LevelPlay SDK requests secure ads only, so ads load without any Info.plist changes.
• Explicitly tells the agent not to set NSAllowsArbitraryLoads (app-wide exposure), not to set NSAllowsArbitraryLoadsInWebContent (on its own it makes the SDK request insecure ads that iOS still blocks outside web views), and not to add NSExceptionDomains for ad networks (the SDK doesn't read them).
• Notes in both ios-setup.md and testing-and-validation.md that LevelPlay's integration validation reports "App Transport Security settings MISSING" with the default configuration, that this is expected, and that it must not be resolved by adding NSAllowsArbitraryLoads.

Documentation only; no behavior change to any code.

[kimberleymday]

Hi Ziyi, thanks for catching this and putting together a fix so quickly. I checked the change against the 9.5.0 iOS SDK and the original ticket behind the secure flag (NS-4910), and I wanted to run a few things by you before this propagates to all three repos.

First, your core fix looks correct. Leaving ATS on makes the SDK tell the auction to return secure ads only, so removing the setting shouldn't stop ads from loading.

Three concerns came up:

1. For NSExceptionDomains: the list of domains that's left as the recommendation doesn't seem to do anything. The SDK doesn't read that setting at all, and ironsrc.com isn't a domain it actually connects to. Could we drop that block and just recommend no ATS settings at all?
2. It's possible the NSAllowsArbitraryLoadsInWebContent suggestion might be problematic. In the implementation note on NS-4910, that key on its own sends secure = 0, so it asks the auction for insecure ads while iOS still blocks them outside web views. Worth removing unless you read that differently.
3. LevelPlay's integration validation prints "App Transport Security settings MISSING" when the setting is absent. Since testing-and-validation.md points developers at the Test Suite to confirm their setup, they'll hit that warning and very likely add the key back. Maybe we could add a line in both ios-setup.md and testing-and-validation.md saying the warning is expected and shouldn't be resolved by setting NSAllowsArbitraryLoads?

Please take a look and let me know whether these are valid points. I might have misread or misunderstood something.

[kimberleymday]

I've checked the updated diff and all three points are addressed: the domain block is gone, the web content key has an explicit warning, and the expected-validation note is in both files with a working cross link. Thanks for the quick revision!