security: detect GitHub Enterprise hosts for marketplace add

[pjdoland]

Summary

The plugin-marketplace source detector recognized public github.com only. A GHE marketplace URL like https://github.acme.com/owner/repo silently:

1. Bypassed allow_github_plugin_import = False. An admin who flipped the policy gate expected GHE adds to be rejected; the detector returned False so they were allowed.
2. Fell through the GitHub-token injection chain. GITHUB_TOKEN / gh auth token resolution only fires when the detector says "this is GitHub." GHE adds went to anonymous git auth and failed with opaque could not read username errors against private repos.

The PR adds a new admin-declarable list of GHE hostnames so both surfaces work for self-hosted GitHub Enterprise.

Solution

New env NBI_GITHUB_ENTERPRISE_HOSTS (CSV) declares the additional hostnames the detector treats as GitHub. Cookie-domain shape:

• bare token (github.acme.com) matches the exact host only
• leading-dot token (.acme.com) matches every subdomain of acme.com

Subdomain matching is opt-in by design. If suffix-matching were the default, declaring acme.com would silently ship GITHUB_TOKEN into the env of any marketplace add against jira.acme.com, artifactory.acme.com, or any other corp service on the same domain. Admins who actually want the broad behavior must spell it out with the leading dot.

The change also refactors is_github_marketplace_source to route both URL and SCP-shorthand branches through a single _is_github_host helper, and fixes a pre-existing oddity: git@anyhost:o/r was incidentally classified as bare owner/repo shorthand because the regex saw "one slash, non-local prefix" and let it through. That would have landed the same token-injection bypass for any unknown SCP host. The shorthand branch now rejects strings containing @ or :.

Second-pass review added two host-detection edges:

• _normalize_host strips a trailing dot before matching. urllib.parse.urlparse preserves the trailing dot on FQDNs (github.com.), so the exact-equality matcher would otherwise silently bypass both the public-github.com recognizer and the GHE-token matcher.
• The URL branch refuses URLs whose userinfo carries a non-git username or any password before treating the extracted host as authoritative. https://attacker@github.com/owner/repo resolves to hostname github.com via urlparse but is a lookalike-attack shape. ssh://git@github.com/... (the legitimate path) is preserved.

Testing

Pytest cases cover:

• URL forms: HTTPS, git://, ssh://, case-insensitive
• SCP forms: git@github.acme.com:owner/repo, case-insensitive, lookalike rejection
• Exact-match-rejects-subdomain-by-default contract
• Leading-dot opt-in to subdomain matching, including "bare apex NOT included"
• CSV with multiple tokens, mixing exact + subdomain shapes
• Lookalike rejection on both URL and SCP shapes (e.g., github.acme.com.evil.test)
• Empty env preserves backward-compatible default
• Trailing-dot FQDN matches for both public-github and GHE shapes
• Embedded-userinfo URL rejection (with ssh://git@... regression guard)
• End-to-end: add_marketplace with GHE URL + allow_github=False raises PermissionError
• End-to-end: add_marketplace with GHE URL injects GITHUB_TOKEN into the CLI env

Full suite green: pytest 792 pass, tsc clean, prettier clean, jest clean.

Risks / follow-ups

• Pre-existing IDN homograph (out of scope here): the detector does no IDNA normalization. A user pasting a visually-spoofed Unicode URL would be rejected by the byte-literal matcher anyway, so the risk is misleading-error rather than silent-bypass. Worth a future doc note if needed.
• The new env is independent of NBI_GHE_SUBDOMAIN (which only configures Copilot OAuth). Doc explicitly calls this out so admins don't assume one covers the other.