.Net: Add server URL validation options for OpenAPI plugins

[SergeyMenshykh]

Motivation and Context

When loading OpenAPI specifications, the SDK uses the servers[].url field to construct HTTP request targets. This PR adds an opt-in mechanism for consumers to validate and restrict which URLs the OpenAPI plugin is allowed to call at runtime.

Description

Introduces RestApiOperationServerUrlValidationOptions, a new options class that can be configured via OpenApiFunctionExecutionParameters.ServerUrlValidationOptions to control outbound request targets:

• AllowedSchemes (IReadOnlyList\<string\>?) — restricts which URI schemes are permitted. When null/empty, defaults to https only.
• AllowedBaseUrls (IReadOnlyList\<Uri\>?) — restricts requests to URLs matching one of the specified base URL prefixes. When null, no base URL restriction is applied.

Validation is performed in RestApiOperationRunner before any HTTP request is sent. When ServerUrlValidationOptions is not set (default), behavior is unchanged — no validation is performed.

Changes

• New class: RestApiOperationServerUrlValidationOptions
• OpenApiFunctionExecutionParameters: added ServerUrlValidationOptions property ([Experimental("SKEXP0040")])
• RestApiOperationRunner: added ValidateUrl() with scheme and base URL checks
• OpenApiKernelPluginFactory: wires validation options through to the runner
• 7 new unit tests covering scheme blocking, base URL allowlisting, and mixed configurations

Usage Example

var plugin = await kernel.ImportPluginFromOpenApiAsync(
    pluginName: "myApi",
    filePath: specPath,
    executionParameters: new OpenApiFunctionExecutionParameters
    {
        ServerUrlValidationOptions = new RestApiOperationServerUrlValidationOptions
        {
            AllowedBaseUrls = [new Uri("https://api.example.com")],
            AllowedSchemes = ["https"]
        }
    });

Contribution Checklist

• The code builds clean without any errors or warnings
• The PR follows the SK Contribution Guidelines and the pre-submission formatting script raises no violations
• All unit tests pass
• New unit tests added