Module: Add Prebid DOOH creative approval support

[AlexChaseJones]

Summary

This PR adds a new prebid.doohcreativeapproval module for Digital Out-of-Home requests. The module gives publishers the ability to approve or reject bidder creatives before they can compete in an auction.

The module is configured through host and publisher account settings. Host config enables the module, defines hook execution, cache limits, concurrency, and default refresh behavior. Publisher account config supplies the approval endpoint, request headers, status TTLs, and optional bidder exemptions.

This is a step toward better support for publisher-controlled creative review in Prebid Server. DOOH publishers may need to review creative content for venue requirements, screen policies, brand safety, or operational restrictions before allowing it to play. This module provides a configurable approval layer without making PBS the durable source of truth for publisher approval state.

What Changed

• Added the prebid.doohcreativeapproval module and registered it in the module builder.
• Added DOOH-only activation through the processed_auction_request hook.
• Added bid filtering through the all_processed_bid_responses hook before winner selection.
• Added publisher-specific approval endpoint, headers, TTL, and exempt-bidder configuration through PBS account module config.
• Added deterministic creative approval IDs derived from PBS account ID, bidder, and bid.crid.
• Added in-process caching for approved, rejected, and pending statuses.
• Added asynchronous background refreshes so approval lookups do not add latency to the auction path.
• Added per-creative request coalescing and configurable concurrency limits for publisher endpoint calls.
• Added last-known-status behavior that preserves cached approvals and rejections when the publisher endpoint is unavailable or returns an unusable response.
• Added bulk approval request and response handling, including validation for missing, malformed, duplicate, and unsupported statuses.
• Added module documentation and an API contract covering configuration, creative identity, endpoint payloads, cache behavior, bidder exemptions, and operational limitations.
• Added unit coverage for configuration, caching, creative extraction, filtering, provider failures, asynchronous refreshes, and concurrency behavior.

Notes

PBS is not the durable approval system. Each PBS process keeps an in-memory cache, while the publisher approval service remains the long-term source of truth.

A first-seen creative is treated as pending and excluded from the current auction while PBS starts a background lookup. Later auctions use the returned status.

Status TTLs control when PBS attempts a refresh; they do not discard the last-known status. If the publisher approval API is unavailable, previously approved creatives continue serving and previously rejected or pending creatives remain filtered. Creatives with no usable prior status remain pending until a successful response is received.

Cache contents and refresh coordination are local to each PBS process. The module does not add a cache inspection or invalidation API.