Spec: Add internet link confirmation requirements

[Copilot]

Clarifies webxdc spec to allow user-initiated internet link navigation with mandatory security controls.

Changes

messenger.md - Extended webview constraints section:

• Explicit allowance for users clicking http:// / https:// links in apps
• MUST requirements for messenger implementations that permit internet access:
  • Display full URL to user
  • Require explicit confirmation before opening
  • Include clear privacy warning in confirmation dialog

CHANGELOG.md - Added version 1.3 entry documenting the specification amendment.

Context

Maintains default internet access denial while providing controlled escape hatch with user consent and transparency.

Users may click on internet links provided by an app
(e.g., `http://` or `https://` URL schemes).
If a messenger implementation chooses to allow
accessing the internet through such links,
it MUST show the full URL to the user and ask for
explicit confirmation before opening the link.
This confirmation dialog MUST include a clear warning
that the link leads to an external website
and may compromise the user's privacy.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.