feat(transport): introduce typed HTTP transport and enforce security boundaries

[robbecker-wf]

Stacked PR: Part 2 of 7

Stack Overview:

1. #443 10x-openapi-spec-baseline -> 10x
2. #444 10x-security-and-transport (this PR) -> 10x-openapi-spec-baseline
3. #445 10x-service-contracts-conformance -> 10x-security-and-transport
4. #446 10x-schema-models-and-strict-analysis -> 10x-service-contracts-conformance
5. #447 10x-test-pyramid-and-smoke -> 10x-schema-models-and-strict-analysis
6. #448 10x-ci-and-spec-sync -> 10x-test-pyramid-and-smoke
7. #449 10x-conformance-plan -> 10x-ci-and-spec-sync

---

Summary

Introduces a typed, injectable HTTP transport layer and enforces strict credential and webhook security boundaries.

• Typed Transport Architecture: Introduces ApiRequest, HttpTransport, RetryPolicy, and ErrorDecoder in lib/src/common/transport/.
• Security Boundaries: Authenticated requests are constrained to configured API origins (api.github.com or custom enterprise endpoint). Credentials are automatically stripped on cross-origin redirects and pagination. Insecure HTTP authentication is disallowed by default unless explicitly opted into via allowInsecureAuth: true.
• Error Redaction & Idempotency: Automatically redacts classic and fine-grained PATs from error messages; truncates oversized error response bodies; retries strictly idempotent HTTP methods (GET, PUT, DELETE, HEAD, OPTIONS) with exponential backoff and jitter, honoring Retry-After and rate-limit reset headers.
• Webhook Hardening: Added constant-time HMAC-SHA256 signature verification, body size limits, structured 400/401/405/413 error responses, and replay detection hooks in lib/src/server/hooks.dart.
• Deprecations: Deprecated UrlShortenerService (enforcing HTTPS) and browser query-string token loading in xplat_browser.dart.