fix: improve HTTP connector validation and data handling

[sodle-splunk]

Summary

• withhold asset credentials from caller-selected file-action hosts
• reject loopback and unspecified IPv4/IPv6 destinations
• stage downloads in generated temporary files
• enable TLS certificate verification by default
• omit sensitive response headers from action results
• bound XML response parsing and reject document type declarations

Each functional fix is isolated in its own commit and release-note line.

Tracking

• PAPP-38201
• PSAAS-30426
• PSAAS-30542
• PSAAS-30585
• PSAAS-31398
• PSAAS-31960
• PSAAS-31992
• Parent epic: ESPM-5228

Validation

• local pre-commit: passed
• hosted pre-commit and compile: pending
• BaseConnector app: no connector unit-test harness required

AI assistance

• This pull request was created entirely with AI assistance.

Written by Codex.

Release impact

This PR contains a breaking configuration change and must ship as a major release. HTTP now verifies server certificates by default; existing assets must trust each target certificate chain or explicitly disable verification. The corresponding functional commit includes a parseable BREAKING CHANGE: trailer for semantic-release.

Merge strategy: merge commit only; do not squash

Release-impact note added by Codex.

[github-actions]

Merging this PR will release 4.0.0 with the following release notes:

4.0.0 (2026-07-30)

Connector release changes

• Updated connector development tooling.
• Prevented file actions from sending asset credentials to caller-selected hosts.
• Blocked IPv4 and IPv6 loopback or unspecified addresses for asset and file-action URLs.
• Stored downloaded content in a generated temporary file so encoded path separators cannot escape the vault staging directory.
• Enabled TLS certificate verification by default for asset and action requests. Existing assets retain their saved setting and should be reviewed after upgrade.
• Removed session- and credential-bearing headers from persisted HTTP action results.
• Rejected XML document type declarations and XML responses larger than 5 MiB before parsing.

[sodle-splunk]

Codex breaking-change review: this PR needs to be redone as a breaking/major release before merge.

Reason: it adds optional verify_server_cert with default: true. Under the updated connector release guidance, changing secure transport/config defaults in a way that can make existing assets fail where they previously succeeded is a breaking change. If the secure default is intentional, please preserve it but add major-release treatment: a parseable BREAKING CHANGE: trailer (or equivalent breaking Conventional Commit), release notes that call out the behavior change and migration impact, and any required PR description updates. If this should remain a non-major release, preserve the previous runtime default instead and document the opt-in secure setting.

Commented by Codex.

[phantom-jacob]

Codex review request: commit 6f7d749b contains literal \n characters in its message body instead of real line breaks. Please amend/rebase the affected commit message so each paragraph is separated by actual newlines and the Codex attribution remains in its own paragraph. Preserve the distinct connector commits and force-push the corrected history; do not squash.

This matters because release tooling expects real multiline commit bodies, especially when parsing trailers.

Commented by Codex.

[phantom-jacob]

Approved by Codex for Jacob after re-review.

[splunk-soar-semantic-release]

🎉 This PR is included in version 4.0.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀