fix(core): validate CDN-supplied apiHost before building upload URL

[sunitaprajapati89]

Summary

• Adds validateApiHost() to util.ts — rejects any apiHost value from the settings CDN that contains a scheme (https://, http://), credentials (user:pass@), query string (?), or fragment (#). Only bare host[/path] values (the format Segment CDN returns) are accepted.
• Guards SegmentDestination.update(): invalid apiHost values are logged as an error and ignored, falling back to the default endpoint instead of interpolating attacker-controlled input into the upload URL.
• Addresses the class of bug introduced in The proxy URL is being altered in version 2.20.4, resulting in an invalid URL #1051 — a tampered or compromised settings response (especially over a misconfigured cdnProxy) could otherwise redirect all event uploads (write key + PII) to an attacker-controlled host.

Test plan

• validateApiHost unit tests: 3 positive cases (bare host, host/path, host:port/path) and 5 negative cases (scheme, credentials, query string, fragment, empty string)
• SegmentDestination integration test: 4 tampered apiHost values all fall back to defaultApiHost
• Existing uses segment settings apiHost for uploading events test confirms the valid path still works
• Run yarn test in packages/core — all tests pass

🤖 Generated with Claude Code