fix: address 4 security findings — env.* expression blocklist, protocol-relative URL sanitization, git hook injection, MCP token permissions#23934

Copilot wants to merge 3 commits into

maingithub/gh-aw:mainfrom

copilot/deep-report-triage-security-findingsgithub/gh-aw:copilot/deep-report-triage-security-findingsCopy head branch name to clipboard