… ### What does this PR do?

Adds `provider` parameter to check configuration to track which config provider (kubernetes, file, etcd, etc.) issued the check config and allow for secure mode when dealing with agent python integrations/checks.

Changes:
- Add `provider` parameter to `Check.Configure()` method
- Add `ConfigProvider()` method to `Check` interface
- Update `CheckBase` to store the provider value
- Update all check implementations to pass the parameter through

#### Configuration Changes

Adds new integration security properties:
- `integration_ignore_untrusted_file_params`: When enabled, integrations ignore file path parameters from untrusted providers
- `integration_file_paths_allowlist`: Allowlist of file paths integrations can access even from untrusted providers
- `integration_trusted_providers`: List of trusted providers (defaults to `["file", "remote-config"]`)
- `integration_security_excluded_checks`: Integration names excluded from security restrictions

These settings enable security controls based on the config provider. Untrusted providers (container labels, pod annotations,

### Motivation

Need to track where check configs come from  to support provider-based security controls in the agent checks.

RFC: https://datadoghq.atlassian.net/wiki/spaces/AI/pages/5802623155/RFC+Remediate+untrusted+checks+configs+in+Integrations

Jira: https://datadoghq.atlassian.net/browse/AI-5322

### Describe how you validated your changes

- Updated all check implementations and tests to pass the provider parameter
- Added tests in `checkbase_test.go` to verify provider is stored and returned correctly
- Existing tests pass with empty string or "provider" placeholder values
- Testing in a kubernetes lab environment using both an existing agent docker image and a pipeline docker image from this #47971 where I update the release.json ints core hash to target the latest commit on this branch, and have a http_check configured via pod annotation and testing for the expected output. (currently waiting for CI to redeploy the environment with the new agent docker image from the pipeline)

Here is a report detailing the experiment: https://datadoghq.atlassian.net/wiki/spaces/~550367931/pages/6428329336/DEMO+Remediate+untrusted+checks+configs+in+Integrations

### Additional Notes

Relates to: DataDog/integrations-core#22226

### Update (2026-03-19)

Addressed review feedback:
- **Assert provider in CGo test mocks**: Added `get_check_provider` and `get_check_deprecated_provider` globals with `strdup`/reset/assertions in `testConfigure` and `testConfigureDeprecated`, matching the pattern used for other parameters
- **Add `ConfigProvider()` to `check.Info` interface**: For symmetry with `ConfigSource()`, so consumers operating on `Info` references don't need a type assertion to `Check` to read the provider. Updated `MockInfo` accordingly.
- **Move `source`/`provider` out of `handleConf` closure**: Assignments were redundantly written twice (once per `handleConf` call). Moved them after both calls alongside `initConfig`/`instanceConfig`.

Co-authored-by: noueman.khalikine <[email protected]>
(cherry picked from commit 07b2c8d)

___

Co-authored-by: NouemanKHAL <[email protected]>