fix(coderd): reject workspace proxy hostname prefixes (#27544)

A workspace proxy hostname prefix could be accepted as a valid proxy
access URL. An authenticated user could then be redirected to an
attacker-controlled domain with an application-connect API key in the
URL.

Require proxy access URL matches to have a hostname boundary after the
candidate hostname, allowing only the end of the URL, a port, or a
path.

Add regression coverage for proxy access URL and wildcard hostname
prefixes.

Refs: https://linear.app/codercom/issue/PLAT-384

---------

Co-authored-by: Bobby Ho <bobbidinho@gmail.com>

coderd/workspaceapps_test.go

@@ -115,6 +115,15 @@ func TestWorkspaceApplicationAuth(t *testing.T) {
 			redirectURI:      "https://proxy.test.coder.com/path",
 			expectRedirect:   "https://proxy.test.coder.com/path",
 		},
+		{
+			name:             "RejectProxyAccessURLPrefix",
+			accessURL:        "https://test.coder.com",
+			appHostname:      "*.test.coder.com",
+			proxyURL:         "https://proxy.test.coder.com",
+			proxyAppHostname: "*.proxy.test.coder.com",
+			redirectURI:      "https://proxy.test.coder/path",
+			expectRedirect:   "",
+		},
 		{
 			name:             "ProxySubdomainOK",
 			accessURL:        "https://test.coder.com",