#21440: fix(msteams): enforce allowlist checks on redirect hops (SSRF) (#11811)

Fixes openclaw/openclaw#11811. Security fix: MSTeams attachment downloads now use manual redirect handling and validate every redirect hop against the allowlist (HTTPS-only) before following, preventing SSRF via allowlisted URL -> disallowed redirect. Also ensures Authorization headers are only attached for hosts in channels.msteams.mediaAuthAllowHosts (no token forwarding to redirect destinations). Docs: - docs/channels/msteams.md: note manual redirect + per-hop allowlist behavior. AI-assisted: yes. Testing: - pnpm vitest run extensions/msteams/src/attachments.test.ts - pnpm check <!-- greptile_comment --> <h3>Greptile Summary</h3> This PR fixes an SSRF vulnerability in MSTeams attachment downloads by implementing manual redirect handling with per-hop allowlist validation. **Key Changes:** - Added `fetchWithManualRedirects` function that validates every redirect hop against the allowlist before following (HTTPS-only) - Authorization headers are now only attached to hosts in the `authAllowHosts` list, preventing token forwarding to redirect destinations - All fetch calls now use `redirect: "manual"` to prevent automatic redirect following before security checks - Comprehensive test coverage for the SSRF prevention scenarios - Documentation updated to describe the manual redirect and per-hop allowlist behavior <h3>Confidence Score: 5/5</h3> - This PR is safe to merge with minimal risk - The security fix is well-implemented with proper validation at every redirect hop, comprehensive test coverage for all edge cases (SSRF prevention, auth header stripping, multi-hop redirects), and clear documentation. The implementation correctly enforces HTTPS-only redirects and prevents credential leakage. - No files require special attention _{Last reviewed commit: d30269f} <!-- greptile_other_comments_section --> _{(4/5) You can add custom instructions or style guidelines for the agent [here](https://app.greptile.com/review/github)!} <!-- /greptile_comment -->