Remove superfluous security feature flags and always enable protections

[geropl]

Description

This PR removes three superfluous security feature flags and ensures the underlying security protections are permanently enabled:

• context_env_var_validation - Environment variable validation now always enabled
• enable_nonce_validation - CSRF protection with nonce validation now always enabled
• enable_strict_authorize_return_to - Strict OAuth returnTo validation now always enabled

Related Issue(s)

Fixes CLC-1618

Security Impact

These changes enhance security by ensuring critical protections cannot be accidentally disabled:

1. Environment Variable Injection Protection (CLC-1591) - Always validates context env vars to prevent code execution attacks
2. CSRF Protection (CLC-1592, CLC-1643, CLC-1642) - Always validates nonces in OAuth flows to prevent unauthorized requests
3. OAuth Redirect Validation - Always validates returnTo URLs to prevent redirect attacks

Changes Made

Code Simplification

• Removed feature flag functions from featureflags.ts
• Removed conditional security checks in authenticator.ts and user-controller.ts
• Updated comments to reflect permanent security measures

Test Updates

• Removed feature flag mocking from test files
• Updated test descriptions to reflect always-enabled security
• Consolidated security validation tests

Testing

• ✅ All relevant unit tests pass (28/28 for affected components)
• ✅ Environment variable validation tests pass
• ✅ OAuth returnTo validation tests pass
• ✅ Code formatting and linting applied

Benefits

• Enhanced Security: Critical security features permanently active
• Reduced Attack Surface: No way to accidentally disable protections
• Simplified Codebase: Removed conditional security logic (-159 lines, +46 lines)
• Consistent Protection: All users benefit from security measures

How to test

1. Environment Variable Validation:

   • Create workspace with dangerous env vars (e.g., BASH_ENV=$(curl|sh)) - should be blocked
   • Create workspace with safe env vars (e.g., VERSION=1.2.3) - should work

2. OAuth Flows:

   • Login/logout with different SCM providers - should work with CSRF protection
   • Bind additional SCM providers - should work with nonce validation
   • Test returnTo URL validation on authorize endpoint - should enforce strict patterns

Documentation

No documentation changes needed - these were internal feature flags not exposed to users.

[geropl]

Reviewed the code myself and it does LGTM ✔️
Let's wait a couple for days (next Wednesday) before dropping, no rush here.

[github-actions]

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.