21c5a6f1dd
Use exact configured host authorities for every REST, GraphQL, and raw client so redirects cannot reattach credentials to foreign hosts or ports. Add adversarial redirect and lookalike coverage. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>