[release/8.0] AppContext for HttpSys CBT hardening

[BrennanConroy]

AppContext for HttpSys CBT hardening

Description

Request from a partner team to allow setting hardened security for their HTTP.Sys applications.

Customer Impact

By default there is no impact, this change is opt-in. If the change is enabled then it sets hardened security for the endpoints exposed by the HTTP.Sys application.

Regression?

• Yes
• No

Risk

• High
• Medium
• Low

Purely opt-in change. We've also verified the change with the partner team.

Verification

• Manual (required)
• Automated

Packaging changes reviewed?

• Yes
• No
• N/A

[dotnet-policy-service]

Hi @@BrennanConroy. If this is not a tell-mode PR, please make sure to follow the instructions laid out in the servicing process document.
Otherwise, please add tell-mode label.

[Copilot]

Pull Request Overview

This PR introduces an opt-in AppContext switch to enable Channel Binding Token (CBT) hardening for HTTP.Sys applications, allowing partner teams to set hardened security for their HTTP.Sys endpoints.

• Adds new native interop types HTTP_AUTHENTICATION_HARDENING_LEVELS enum and HTTP_CHANNEL_BIND_INFO struct to support CBT hardening configuration
• Implements AppContext switch Microsoft.AspNetCore.Server.HttpSys.EnableCBTHardening to conditionally apply medium-level authentication hardening during UrlGroup initialization
• Removes unused using statements from HttpApiTypes.cs

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/Shared/HttpSys/NativeInterop/HttpApiTypes.cs	Defines native interop types for CBT hardening (enum and struct) and removes unused using statements
src/Servers/HttpSys/src/NativeInterop/UrlGroup.cs	Implements opt-in CBT hardening in UrlGroup constructor via AppContext switch, sets HttpServerChannelBindProperty when enabled

[Copilot]

The HTTP_CHANNEL_BIND_INFO struct has a Flags field (see line 666 in HttpApiTypes.cs) that should be set, following the pattern used in other property setters in this class (e.g., SetDelegationProperty, AttachToQueue, SetMaxConnections). Consider setting Flags = (uint)HttpApiTypes.HTTP_FLAGS.HTTP_PROPERTY_FLAG_PRESENT to indicate the property is present.