… (#26623)

Backport of #26545 to `release/2.29`.

Original PR: #26545 - chore: skip failing azureidentity test while under
investigation
Merge commit: a12b051
Requested by: @ethanndickson

Skips `TestValidate` in `coderd/azureidentity`, which fails on the
release branch due to Azure instance-identity certificate chain
verification (`certificate signed by unknown authority`), unrelated to
release content. This mirrors the skip added on `main` in #26545. The
cherry-pick conflicts only on surrounding context because this branch
has a `darwin`-only skip block right after `t.Parallel()`; the
unconditional skip is inserted ahead of it to match main, consistent
with the existing `release/2.32` and `release/2.33` backports.

Ref: coder/internal#1602

Backport of #26600 to `release/2.29`.

Original PR: #26600 - fix: pin workspace agent API client to intended
agent
Merge commit: eeb2624
Requested by: @ethanndickson

## What this fixes

The workspace agent API client followed HTTP redirects and trusted the
redirected host, letting a malicious agent bounce a coderd request onto
a different agent's unauthenticated port-4 API (cross-tenant file
read/write and RCE, Cure53 CODAGT-668). `apiClient` now refuses
redirects and pins every dial to the intended agent address, and the
task-app / scaletest clients share `AppHTTPClient`, which blocks
redirects too.

## Conflict resolution

This 2.29 ESR backport was resolved using the existing `release/2.32`
backport (#26612) as a reference; that resolution applies cleanly here.
#26600 was built on a separate request-context refactor of `apiClient`
that is not present on this release branch, so the redirect block and
agent-address pinning are applied to the existing `apiClient()`, and the
request-context-bounded dial test (which depends on that refactor) is
omitted. This branch had no `agentconn_test.go`, so the redirect
regression tests are added as a new `agentconn_test.go`. The generated
agent-conn mock additionally required its `net/http` import for the new
`AppHTTPClient` method.