[Security] SSRF via unvalidated GitHub Enterprise URL in Copilot plugin

[tejas0077]

Summary

The GitHub Copilot plugin accepts a user-supplied enterpriseUrl for
GitHub Enterprise deployments. The input is only validated for URL format
(valid hostname exists) but not checked against safe domain patterns.

Impact

An attacker can supply internal addresses (127.0.0.1, localhost,
192.168.x.x) or attacker-controlled domains, causing CyberStrike to:

• Make OAuth device code requests to unintended endpoints
• Forward Bearer tokens to attacker-controlled servers

Classification

CWE-918 (Server-Side Request Forgery)

Fix

PR #22 adds domain allowlist validation and blocks internal/loopback
addresses at both the UI validation layer and inside authorize().

Fixes #22