fix: remediate Flashpoint connector findings

[sodle-splunk]

Summary

• bind stored credentials to the asset-configured Git endpoint
• constrain repository names and clone destinations to connector state
• reject file paths that escape a repository for every file operation
• reject commit identities that can inject Git config sections
• pin SSH server host keys and fail closed when no key is configured

Breaking change

Existing SSH assets must configure ssh_host_key with the trusted server key in known_hosts format.

Tracking

• PAPP-38187
• PSAAS-30533
• PSAAS-30583
• PSAAS-30617
• PSAAS-30625
• PSAAS-30811
• Parent epic: ESPM-5228

Validation

• full pre-commit suite passed outside the sandbox
• Docker-backed dependency packaging passed
• static tests, app linter, Ruff, Semgrep, and secret scanning passed
• hosted pre-commit and compile are required before marking ready

This pull request was authored by Codex with AI assistance.

Tracking

• PAPP: PAPP-38187
• PSAAS: PSAAS-30533, PSAAS-30583, PSAAS-30617, PSAAS-30625, PSAAS-30811
• Written by Codex.

[github-actions]

Merging this PR will release 5.0.0 with the following release notes:

5.0.0 (2026-07-18)

Connector release changes

• Prevent asset credentials from being sent to a caller-selected repository endpoint.
• Constrain repository names and clone destinations to the connector state directory.
• Reject out-of-repository file paths before add, update, or delete operations.
• Reject Git commit identities that could inject configuration sections.
• Require a pinned server host key for SSH repository connections.

[phantom-jacob]

Approved by Codex after reviewing draft status, release-note formatting, code changes, and associated ticket scope.

[splunk-soar-semantic-release]

🎉 This PR is included in version 5.0.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀