Sidecar: add per-route override gating and harden BaseUrl handling

[iNinja]

Description

Adds explicit, per-route control over whether optionsOverride.* query-string parameters are honoured by the sidecar's /AuthorizationHeader[/Unauthenticated] and /DownstreamApi[/Unauthenticated] endpoints, and unconditionally rejects optionsOverride.BaseUrl on every route.

Behaviour change

New configuration section Sidecar:AllowOverrides with four boolean flags:

Key	Default
Sidecar:AllowOverrides:AuthorizationHeader	true
Sidecar:AllowOverrides:AuthorizationHeaderUnauthenticated	false
Sidecar:AllowOverrides:DownstreamApi	true
Sidecar:AllowOverrides:DownstreamApiUnauthenticated	false

When the flag for a route is false, any optionsOverride.* parameters on the request are dropped at bind time, the configured options are used as-is, and a single OverridesIgnored warning is logged with the route name. The request is still served — there is no 4xx.

optionsOverride.BaseUrl is rejected on every route regardless of the gating flag, with a BaseUrlOverrideIgnored warning. The OpenAPI document marks the optionsOverride.BaseUrl parameter as deprecated.

The unauthenticated routes default to false so that anonymous callers cannot influence outbound request shape; authenticated routes keep the existing permissive behaviour for backwards compatibility, but are now opt-out via configuration.

What's included

• src/Microsoft.Identity.Web.Sidecar/Configuration/SidecarOptions.cs — new AllowOverrides nested options class with the four flags above.
• src/Microsoft.Identity.Web.Sidecar/Models/BindableDownstreamApiOptions.cs — BindAsync now scans optionsOverride.* keys, drops BaseUrl early with a log, and only sets HasAny when a non-BaseUrl override is present (so a BaseUrl-only request produces a single warning, not two).
• src/Microsoft.Identity.Web.Sidecar/Endpoints/AuthorizationHeaderEndpoint.cs, DownstreamApiEndpoint.cs — per-route lambdas inject IOptions<SidecarOptions> and pass allowOverrides plus a route-name string into the shared async handler.
• src/Microsoft.Identity.Web.Sidecar/Logging/Logging.cs — OverridesIgnored(routeName) (EventId 3) and BaseUrlOverrideIgnored() (EventId 4).
• src/Microsoft.Identity.Web.Sidecar/OpenAPI/Microsoft.Identity.Web.Sidecar.json — regenerated with the optionsOverride.BaseUrl parameter marked deprecated.
• tests/E2E Tests/Sidecar.Tests/SidecarOverrideGatingTests.cs — 6 E2E tests covering each route × allow/deny combination.
• tests/E2E Tests/Sidecar.Tests/ModelsTests.cs — 4 unit tests against BindAsync covering HasAny semantics (non-BaseUrl override, BaseUrl-only, mixed, none).
• tests/E2E Tests/Sidecar.Tests/OptionsOverrideHeaderHandlingTests.cs — 2 cross-cutting tests, currently [Fact(Skip = "Pending dependency merge")]. These will be unskipped once PR 1 merges and master is merged back into this branch.

Notes for reviewers

• No breaking change for existing deployments that only use the authenticated routes — defaults preserve current behaviour there.
• Deployments that exposed /AuthorizationHeader/Unauthenticated or /DownstreamApi/Unauthenticated and relied on caller-supplied optionsOverride.* will need to opt back in by setting the corresponding flag to true.
• The 2 skipped tests in OptionsOverrideHeaderHandlingTests.cs exercise the library-level header handling change from DownstreamApi: ignore caller-supplied reserved or duplicate headers in ExtraHeaderParameters #3793 through the sidecar surface; they pass locally on a branch that has both PRs applied. The skip is purely a sequencing convenience.