fix(security): block URL-encoded injection patterns in SecurityValidator.validate_url()

[bogdanmariusc10]

🔗 Related Issue

Closes #4318
Jira Issue: https://jsw.ibm.com/browse/ICACF-19

---

📝 Summary

This PR fixes a security vulnerability in SecurityValidator.validate_url() where URL-encoded injection patterns could bypass security checks. The gateway test endpoint and 6 other endpoints were vulnerable to CRLF injection, XSS, and JavaScript protocol injection via percent-encoding.

Root Cause: Security pattern checks operated on the original URL string before decoding, allowing attackers to hide malicious patterns using URL encoding (e.g., %0d%0a for CRLF, %3Cscript%3E for XSS).

Fix: Added urllib.parse.unquote() to decode URLs before all pattern-based security checks while preserving structural validation on the original URL.

Impact: Protects all 7 endpoints using SecurityValidator.validate_url() across the codebase from injection attacks.

---

🏷️ Type of Change

• Bug fix
• Feature / Enhancement
• Documentation
• Refactor
• Chore (deps, CI, tooling)
• Other (describe below)

---

🧪 Verification

Check	Command	Status
Lint suite	make lint	✅
Unit tests	make test	✅
Coverage ≥ 80%	make coverage	✅

Security Testing: All 27 injection test vectors now blocked:

• ✅ CRLF injection (literal \r\n and encoded %0d%0a)
• ✅ XSS attacks (<script> and %3Cscript%3E)
• ✅ JavaScript protocol (javascript: and javascript%3A)
• ✅ Credential injection (user:pass and user%3Apass)
• ✅ Space injection and IPv6 bypasses
• ✅ All valid URLs still accepted

---

✅ Checklist

• Code formatted (make black isort pre-commit)
• Tests added/updated for changes
• Documentation updated (if applicable)
• No secrets or credentials committed

---

📓 Notes

Security Impact: This vulnerability allowed attackers to bypass URL validation using percent-encoding. For example:

• http://example.com/%0d%0aInjected-Header:Exploit (CRLF injection)
• http://example.com/%3Cscript%3Ealert(1)%3C/script%3E (XSS)

Protected Endpoints:

1. Gateway test endpoint (/admin/gateways/test)
2. Tool URL validation
3. LLM provider service URLs
4. OpenAPI spec URLs
5. LLM chat router URLs
6. Plugin framework URLs
7. LLM proxy service URLs

Implementation Details:

• Decode once at start of validate_url() using urllib.parse.unquote()
• Use decoded_value for all pattern-based security checks
• Keep structural checks (scheme, IPv6, length) on original value
• Return original URL (not decoded) for actual use

Backward Compatibility: ✅ No breaking changes - all valid URLs continue to work as before.