fix(security): harden MCP client and scanner against untrusted input

[appleboy]

Summary

• Critical: Bound io.ReadAll() with LimitReader in HTTP/SSE transports to prevent memory exhaustion DoS from malicious MCP servers
• Critical: Validate SSE endpoint URLs against base origin using net/url parsing to prevent SSRF attacks
• Critical: Prevent symlink traversal in skill directory scanning with filepath.EvalSymlinks() and path containment checks
• High: Parse --control-server-H headers into ControlServerConfig (flag was defined but never wired up)
• High: Redact query parameters from URLs and sensitive args in all debug log output
• Medium: Add sync.Mutex to protect stdio stderr slice from data race
• Medium: Extract shared HTTP error types (ClientError, NonRetryableError, SanitizeBodySnippet) to internal/httperrors/ to eliminate duplication between upload and analysis packages
• Medium: Expand secret prefix detection from 5 to 18 known API key patterns plus a high-entropy heuristic
• Medium: Thread configurable --server-timeout through to session.call() instead of hard-coded 30s
• Medium: Remove unused --mcp-oauth-tokens-path flag (dead code)

Test plan

• All existing tests pass with race detector (go test -race ./...)
• New tests for SSE endpoint URL validation (7 cases: relative, absolute same-origin, different origin, different scheme, path traversal, different port)
• New tests for symlink traversal protection and isWithinBase boundary checks
• New tests for control server header parsing
• New tests for URL and arg sanitization
• New tests for expanded secret prefix detection and entropy heuristic
• New tests for shared httperrors package
• make lint passes with 0 issues
• make build succeeds

🤖 Generated with Claude Code