## Summary

Documentation for security hardening changes shipping in the SDK PRs:
- microsoft/teams.ts#515
- microsoft/teams.py#370
- microsoft/teams.net#418

### New page: Service URL Validation

`src/pages/templates/essentials/service-url-validation.mdx` +
per-language include files

Documents the service URL domain allowlist:
- Allowed hostnames by cloud environment preset
- How to add custom domains via `additionalAllowedDomains`
- Sovereign cloud FQDNs that require manual configuration
- How to disable validation with wildcard `*`
- Note on proactive messaging

## Test plan

- [x] Docusaurus builds without errors
- [x] New page renders correctly for all 3 languages
- [x] Admonitions render correctly

Follow-up to the allowlist feature (shipped via #515). No runtime
behavior change for correct callers. Adds hardening informed by review
feedback on the sibling Python PR (microsoft/teams.py#404):

1. **Docstring clarity.** `App.additionalAllowedDomains`,
`HttpServerOptions`, and `ServiceTokenValidator` constructor all
document that entries must be bare hostnames matched exactly
(case-insensitive); wildcard patterns like `*.example.com`, URL
suffixes, and full URLs are NOT supported. `['*']` is the sole wildcard,
used as a disable-validation sentinel.
2. **Defensive copy.** `HttpServer` and `ServiceTokenValidator` no
longer store the caller's array by reference. A post-construction
mutation of the caller's array would previously have changed validator
behavior at runtime; now it is isolated.
3. **Tests** covering the class of bug Python shipped in #404: plumbing
from `HttpServerOptions` through `HttpServer.initialize()` into the
`ServiceTokenValidator` constructor.

---------

Co-authored-by: Copilot <[email protected]>

## Summary

Reverting the serviceUrl allowlist defense-in-depth feature before
public release. Open design questions on the work item (default
sovereign cloud domains, narrowing of `*.botframework.com`, applying to
proactive `ConversationReference`s, consultation with APX) should be
resolved before this becomes part of the public API surface.

This feature has not shipped in any release. Removing the public
`additionalAllowedDomains` option is a breaking change for anyone
building from `main`, which is not ideal but acceptable since no release
has been cut. Reverting now buys time to discuss without breaking
customers later.

## Removed

- `isAllowedServiceUrl` helper
- `additionalAllowedDomains` option on `AppOptions` and
`HttpServerOptions`, plus plumbing through `App` -> `HttpServer` ->
`ServiceTokenValidator`
- `CloudEnvironment.allowedServiceUrls` field, per-cloud entries
(Public/USGov/USGovDoD/China), and `withOverrides` parameter
- Service URL hostname check in the skip-auth path of
`HttpServer.authorize`
- All allowlist tests (`additionalAllowedDomains plumbing`, cloud preset
acceptance/rejection, wildcard, defensive copy, etc.)

## Preserved (other security work bundled into PR #515)

- Scope validation (exact set membership)
- `isCallToolResult` fix in `external/mcp`

## Preserved (sovereign cloud, separate work)

`CloudEnvironment` presets, `withOverrides`, `cloudFromName`, `cloud`
option on `App`, and the `cloud` parameter on `ServiceTokenValidator`
are unchanged.

## Test plan

- [x] `npm run build` clean (full workspace)
- [x] `npm run lint` clean
- [x] `npx jest` in `packages/apps`: 19 suites, 245 tests pass
- [x] `tsc --noEmit` clean for `packages/apps` and `packages/api`
- [x] Smoke test: `examples/echo` starts and binds to port