fix(coderd): block SSRF in MCP OAuth2 discovery and client registration - #27989

MCP OAuth2 auto-discovery and Dynamic Client Registration fetched attacker-influenced URLs (the MCP server URL plus any endpoints or redirects it advertises) with a plain HTTP client. A hostile MCP server could redirect these discovery fetches to internal destinations such as cloud metadata (169.254.169.254) or loopback-only services, with part of the response surfacing through the API error detail (Cure53 CDM-02-002, partially-blind SSRF).

All discovery and registration traffic now goes through a dedicated SSRF-guarded HTTP client: each hostname is resolved once, destinations in private, loopback, link-local, multicast, unspecified, and special-use ranges are rejected, and a validated IP is dialed directly so DNS rebinding cannot swap in a private address between validation and connect. Redirects pass through the same guarded dialer, IPv4-mapped IPv6 literals are unmapped before matching, and the client never uses a proxy because the destination IP would be invisible to the dialer. The "partially blind" leak channel is also closed: failing registration responses no longer have their body echoed into the API error detail, only the HTTP status code. Manually configured OAuth2 endpoints are unaffected; only auto-discovery against internal addresses now fails by design. coderd.Options gains an internal allowlist seam so tests can serve mock MCP servers on loopback; this is intentionally not user-facing configuration.

Regression tests assert that an internal loopback canary receives zero requests across redirect scenarios (discovery GET, registration POST, metadata IP, DNS-resolving hostnames) at both the unit and API level, and that upstream response bodies never appear in returned errors.

Scope notes (relation to earlier remediation notes on CODAGT-784)

The Linear issue carries an earlier assessment and a prior remediation attempt (commit 0b3dc89540, never opened as a PR; its branch no longer exists). This PR supersedes that work with a narrower, deliberate scope:

• No public escape-hatch flag: the earlier attempt added CODER_MCP_ALLOWED_PRIVATE_CIDRS. This PR intentionally ships no user-facing bypass for a security fix; the allowlist exists only as an internal coderd.Options test seam. Deployments with intentionally internal MCP servers can configure OAuth2 endpoints manually, and a reviewed operator flag can be added later if needed.
• Token exchange/refresh and the MCP transport connection use stored admin-entered configuration rather than attacker-steered discovery data and are tracked as adjacent surfaces on SEC-264 rather than folded into this change.
• The dogfood evidence attached to CODAGT-784 (blocked toast, canary PASS) was captured against the earlier build, not this diff; this PR's equivalent coverage is the automated regression suite.

Closes CODAGT-784 (remediation for SEC-264 / Cure53 CDM-02-002).

Generated with mux