fix(auth): add security hardening and federated config for Auth0 logout

Add server-side URL validation for logoutUrl (HTTPS + localhost only),
origin validation on the logout endpoint, and a configurable `federated`
option (default false) for Auth0 provider logout. Includes comprehensive
test coverage for all security controls.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Jack Palmer <jackpalmer@spotify.com>

packages/core-app-api/src/lib/AuthConnector/DefaultAuthConnector.test.ts

@@ -301,4 +301,16 @@ describe('DefaultAuthConnector', () => {
     await connector.removeSession();
     // Should complete without error — non-JSON responses are ignored
   });
+
+  it('should ignore logoutUrl with non-HTTPS protocol', async () => {
+    server.use(
+      rest.post('*', (_req, res, ctx) =>
+        res(ctx.json({ logoutUrl: 'http://evil.com/steal' })),
+      ),
+    );
+
+    const connector = new DefaultAuthConnector(defaultOptions);
+    await connector.removeSession();
+    // Should complete normally without redirecting - http:// is rejected
+  });
 });