fix(auth-backend): harden default allowed patterns for CIMD and DCR (#34260)

* fix(auth-backend): harden default allowed patterns for CIMD and DCR

Signed-off-by: benjdlambert <ben@blam.sh>

* address PR review feedback for OIDC defaults

- narrow CLI client ID pattern to exact cli.json path
- add BREAKING prefix to changeset
- add IPv6 [::1] to docs examples
- add loopback redirect URI tests for IPv6 and 127.0.0.1

Signed-off-by: benjdlambert <ben@blam.sh>

* remove dead ['*'] fallback when features are disabled

The restrictive defaults are now always used regardless of the enabled
flag, since the patterns are only consulted on code paths that require
the feature to be enabled.

Signed-off-by: benjdlambert <ben@blam.sh>

* add default pattern tests and fix docs cli example

Signed-off-by: benjdlambert <ben@blam.sh>

* use URL constructor for CLI client ID

Signed-off-by: benjdlambert <ben@blam.sh>

* use string templating for cliClientId to match OidcRouter

Signed-off-by: benjdlambert <ben@blam.sh>

* fix docs: remove misleading CLI client_id URL example

Signed-off-by: benjdlambert <ben@blam.sh>

---------

Signed-off-by: benjdlambert <ben@blam.sh>

.changeset/harden-oidc-defaults.md

@@ -0,0 +1,37 @@
+---
+'@backstage/plugin-auth-backend': minor
+---
+
+**BREAKING**: Hardened the default allowed patterns for CIMD and DCR to replace the previous permissive `['*']` wildcards with specific defaults for known MCP clients. If you previously relied on the default `['*']` patterns, you will need to explicitly configure the patterns you need in your `app-config.yaml`.
+
+**CIMD (`experimentalClientIdMetadataDocuments`):**
+
+- `allowedClientIdPatterns` now defaults to Claude, VS Code, and the built-in Backstage CLI instead of `['*']`
+- `allowedRedirectUriPatterns` now defaults to loopback addresses (localhost, 127.0.0.1, [::1]) instead of `['*']`
+
+**DCR (`experimentalDynamicClientRegistration`):**
+
+- `allowedRedirectUriPatterns` now defaults to Cursor and loopback addresses instead of `['*']`
+
+If you need to allow additional clients or redirect URIs, you can override these defaults in your `app-config.yaml`:
+
+```yaml
+auth:
+  experimentalClientIdMetadataDocuments:
+    enabled: true
+    allowedClientIdPatterns:
+      - 'https://claude.ai/*'
+      - 'https://vscode.dev/*'
+      - 'https://my-custom-client.example.com/*'
+    allowedRedirectUriPatterns:
+      - 'http://localhost:*'
+      - 'http://127.0.0.1:*'
+      - 'https://my-app.example.com/callback'
+  experimentalDynamicClientRegistration:
+    enabled: true
+    allowedRedirectUriPatterns:
+      - 'cursor://*'
+      - 'http://localhost:*'
+      - 'http://127.0.0.1:*'
+      - 'myapp://*'
+```