fix(pages): security hardening: only serve to our origin

[david-allison]

Note

Assisted-by: GPT-6 - proposed and implemented while updating the backend, I cleaned it up

Purpose / Description

Ensure that pages such as 'Deck Options' cannot be used to load external web pages which can then load internal anki assets from the backend, or call into Anki APIs

Fixes

• Part of Integrate Anki 26.09 #21926
  • General security hardening for the update

Approach

• define isInternalUrl
  • Don't serve assets if this is false
• Open webpages externally if they're not in an allowlist to ensure they can't access our APIs
  • Except docs.ankiweb

How Has This Been Tested?

Tests added

Checklist

• You have a descriptive commit message with a short title (first line, max 50 chars).
• You have commented your code, particularly in hard-to-understand areas
• You have performed a self-review of your own code
• UI changes: include screenshots of all affected screens (in particular showing any new or changed strings)
• UI Changes: You have tested your change using the Google Accessibility Scanner

[mikehardy]

Local CI-parity on a rebase onto current main: jacocoUnitTestReport failed (twice, including after :AnkiDroid:clean) with:

PrefsSearchBarTest → Could not resolve fragment for xml/preferences_review_reminders

Investigation notes:

• This PR only touches pages/WebView hardening (no preferences changes)
• GitHub unit CI is green
• Isolated PrefsSearchBarTest passes; full suite fails
• Same local failure pattern as #22141 on this host
• Root suspicion: HeaderFragment.configureSearchBar indexes R.xml.preferences_review_reminders when Prefs.newReviewRemindersEnabled, but getFragmentFromXmlRes has no branch for that XML — so if any earlier test leaves the flag enabled, this assertion fails (suite-order pollution)

Holding Approve/enqueue until local full unit is green (or the prefs mapping / test isolation is fixed). Lint + emulator local lanes were green.

[github-actions]

Snapshot diff report: Previous regressions were resolved by the latest commit.

[david-allison]

• Investigating the flake: Flaky test: PrefsSearchBarTest #22207

Flake has been split off; requesting re-review

[mikehardy]

Hey David 👋

LGTM — origin-locked asset serving and fail-closed external navigation match the hardening slice for #21926, and the PageWebViewClient / DeckOptions tests lock that in.

Local lint / unit / package / emulator are green on a rebase onto current main (full unit suite; PrefsSearchBar suite-order red is gone after #22209). Happy to merge.