) (#26621)

Backport of #26545 to `release/2.32`.

Original PR: #26545 - chore: skip failing azureidentity test while under
investigation
Merge commit: a12b051
Requested by: @ethanndickson

Skips `TestValidate` in `coderd/azureidentity`, which fails on the
release branch due to Azure instance-identity certificate chain
verification (`certificate signed by unknown authority`), unrelated to
release content. This mirrors the skip added on `main` in #26545. The
automatic cherry-pick conflicted only on surrounding context because
this branch has a `darwin`-only skip block right after `t.Parallel()`;
the unconditional skip is inserted ahead of it to match main.

Ref: coder/internal#1602

Co-authored-by: Ethan Dickson <[email protected]>

Backport of #26600 to `release/2.32`.

Original PR: #26600 - fix: pin workspace agent API client to intended
agent
Merge commit: eeb2624
Requested by: @ethanndickson

## What this fixes

The workspace agent API client followed HTTP redirects and trusted the
redirected host, letting a malicious agent bounce a coderd request onto
a different agent's unauthenticated port-4 API (cross-tenant file
read/write and RCE, Cure53 CODAGT-668). `apiClient` now refuses
redirects and pins every dial to the intended agent address, and the
task-app / scaletest clients share `AppHTTPClient`, which blocks
redirects too.

## Conflict resolution

The automatic cherry-pick conflicted because #26600 was built on a
separate request-context refactor of `apiClient` that is not present on
this release branch. The redirect block and agent-address pinning are
applied to the existing `apiClient()` here, and the
request-context-bounded dial test (which depends on that refactor) is
omitted. This branch had no `agentconn_test.go`, so the redirect tests
are added as a new `agentconn_test.go`. The two redirect regression
tests added by #26600 are included.

Co-authored-by: Ethan Dickson <[email protected]>

…arded Host header (#26656) (#26711)

Backport of #26656

Original PR: #26656 — fix(enterprise/aibridgeproxyd): stop injecting
default port into forwarded Host header
Merge commit: c41d219
Requested by: @ssncferreira

---------

Co-authored-by: Garrett Delfosse <[email protected]>

)