[SILO-1014] fix: restrict OAuth redirect URIs and disable CORS credentials (#72)

* [MCP-1] feat: build check workflow (#15)

* fix: added build check workflow

* chore: typo fixes

* release: v0.1.5

* fix: restrict OAuth redirect URIs and disable CORS credentials

Add allowed_client_redirect_uris to restrict redirects to localhost and
known MCP client protocols. Disable CORS credentials to prevent
cross-origin token theft. Add E2E security tests that replay the
reported attack chain.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: sriram veeraghanta <veeraghanta.sriram@gmail.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>