fix(check-rendered-specs): add source-origin preflight guard

[liunan-ms]

This PR adds a preflight source-origin allowlist check before azldev component update/render in the rendered-spec PR path. The new guard validates the resolved Fedora dist-git and lookaside URIs from azldev config dump and fails fast if they differ from the trusted Fedora endpoints, preventing fork PRs from redirecting source fetches to attacker-controlled infrastructure.

Fixes: AB#22017

[Copilot]

Pull request overview

This PR adds a defense-in-depth preflight guard to the rendered-specs PR check workflow to ensure the resolved Fedora dist-git, lookaside, and source repo base URIs match a trusted allowlist before running azldev component update / azldev component render, reducing the risk of fork PRs redirecting source fetches.

Changes:

• Added a new Python guard script that reads azldev config dump -f json and validates Fedora source-origin URIs against an allowlist.
• Wired the guard into the GitHub Actions rendered-specs check workflow so it runs before lock updates and before renders (inside the container).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
scripts/ci/render-specs-check/source_origin_guard.py	New source-origin allowlist validator for resolved Fedora endpoints from azldev config dump.
.github/workflows/check-rendered-specs.yml	Runs the new guard inside the container before azldev component update and before render logic.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

[tobiasb-ms]

issue(non-blocking): I'd prefer if you rebased so this is one commit -- the second commit is logically part of the initial implementation.

[christopherco]

Code changes themselves look good. Requesting to update your commit message in your commit to add a short explanation of the changes. We're doing rebase-merge commits of PRs now, so the commit itself is what is added to the final git tree, including its commit title and message. We need our future git log to have useful commit message information.