SKUs: if the request id is not present, backfill using item id

[evq]

Resolves brave/brave-browser#35158

Submitter Checklist:

• I confirm that no security/privacy review is needed and no other type of reviews are needed, or that I have requested them
• There is a ticket for my issue
• Used Github auto-closing keywords in the PR description above
• Wrote a good PR/commit description
• Squashed any review feedback or "fixup" commits before merge, so that history is a record of what happened in the repo, not your PR
• Added appropriate labels (QA/Yes or QA/No; release-notes/include or release-notes/exclude; OS/...) to the associated issue
• Checked the PR locally:
  • npm run test -- brave_browser_tests, npm run test -- brave_unit_tests wiki
  • npm run lint, npm run presubmit wiki, npm run gn_check, npm run tslint
• Ran git rebase master (if needed)

Reviewer Checklist:

• A security review is not needed, or a link to one is included in the PR description
• New files have MPL-2.0 license header
• Adequate test coverage exists to prevent regressions
• Major classes, functions and non-trivial code blocks are well-commented
• Changes in component dependencies are properly reflected in gn
• Code follows the style guide
• Test plan is specified in PR before merging

After-merge Checklist:

• The associated issue milestone is set to the smallest version that the
  changes has landed on
• All relevant documentation has been updated, for instance:
  • https://github.com/brave/brave-browser/wiki/Deviations-from-Chromium-(features-we-disable-or-remove)
  • https://github.com/brave/brave-browser/wiki/Proxy-redirected-URLs
  • https://github.com/brave/brave-browser/wiki/Fingerprinting-Protections
  • https://github.com/brave/brave-browser/wiki/Brave%E2%80%99s-Use-of-Referral-Codes
  • https://github.com/brave/brave-browser/wiki/Web-Compatibility-Exceptions-in-Brave
  • https://github.com/brave/brave-browser/wiki/QA-Guide
  • https://github.com/brave/brave-browser/wiki/P3A

Test Plan:

[husobee]

lgtm

[evq]

apologies for the hiatus, I temporarily turned this PR back into a draft while I investigated the interaction of this with some other pending changes server side. I've attached my notes on the various scenarios below.

---

before server side changes

current upgrade issue scenario:

1. credentials generated
2. credentials submitted to old endpoint
3. fails, e.g. due to conflict
4. user upgrades to new version
5. user is prompted to log in / click "refresh" ( DELETE is called )
6. credentials already generated are submitted with new random request id

case A: success

case B (success but times out):

7. credentials submit but time out
8. retry occurs, new random id
9. submit with new random id fails due to conflict, goto 5

upgrade issue scenario after this PR:

1-6: ...

case A: success

case B:

7. credentials submit but time out
8. retry occurs, deterministic id
9. submit with same id succeeds, goto 7

case C (multi device, request id conflict):

7. credentials fail to submit due to request id conflict
8. goto 5

after pending server side changes

current upgrade issue scenario:

1-6: ...
7. submit will always fail due to a conflict since DELETE does not delete

upgrade issue scenario after this PR:

1-6:...

case A: success

case B:

7-9: same as post-PR case B above

case C:

7-9: same as post-PR case C above