Sidecar: add loopback-only access

[soodt]

Sidecar: add loopback-only access

• You've read the Contributor Guide and Code of Conduct.
• You've included unit or integration tests for your change, where applicable.
• You've included inline docs for your change, where applicable.
• There's an open issue for the PR that you are making. If you'd like to propose a new feature or change, please open an issue to discuss the change or find an existing issue.

Summary of the changes (Less than 80 chars)

Description

Restrict sidecar endpoints to loopback callers

Fixes #{bug number} (in this specific format)

[Copilot]

Pull request overview

This PR tightens the Sidecar’s network exposure by replacing host-header filtering with a loopback-only caller restriction (while keeping the health probe endpoint reachable from non-loopback addresses).

Changes:

• Add a loopback-only middleware (UseLocalCallerRestriction) that blocks non-loopback callers with 403, exempting the health endpoint.
• Update Sidecar startup pipeline to apply the loopback restriction in non-development environments and explicitly register auth middleware after it.
• Replace prior host-filtering E2E coverage with new E2E tests validating loopback vs non-loopback behavior (including health endpoint exemption).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
tests/E2E Tests/Sidecar.Tests/LocalCallerRestrictionTests.cs	Adds E2E coverage for loopback-only enforcement and health endpoint exemption.
tests/E2E Tests/Sidecar.Tests/HostFilteringTests.cs	Removes E2E coverage for the previous host filtering approach.
src/Microsoft.Identity.Web.Sidecar/Program.cs	Switches from host filtering to loopback restriction and adjusts middleware ordering.
src/Microsoft.Identity.Web.Sidecar/LocalCallerRestriction.cs	Introduces loopback-only restriction middleware and loopback detection helper.