fix: add DNS-rebinding protection to _OriginCheckMiddleware

[XananasX7]

Summary

This PR adds DNS-rebinding protection to the _OriginCheckMiddleware in the ADK web server.

Vulnerability

When the ADK development server is bound to a loopback address (127.0.0.1 / ::1 / localhost) — the default — and no explicit --allow-origins list is configured, a DNS-rebinding attack allows a malicious web page to make authenticated cross-origin requests to the local server.

Attack Steps

1. Attacker controls evil.com and serves a malicious page there.
2. Victim visits http://evil.com (or is redirected there).
3. Attacker changes evil.com's DNS to point to 127.0.0.1.
4. The attacker's JavaScript issues a POST to http://evil.com:8000/run.
5. The browser sends Origin: http://evil.com and Host: evil.com.
6. Before this fix: _get_request_origin() derives the "request origin" from the Host header (http://evil.com) and _is_request_origin_allowed() sees origin == request_origin → ALLOW.
7. The attacker can call /run with arbitrary prompts, read session history, exfiltrate memory, etc.

This is analogous to the DNS-rebinding protection added to the MCP go-sdk SSEHandler (DisableLocalhostProtection option).

Fix

Added two helpers:

• _is_loopback_address(host) — correctly identifies 127.x.x.x, localhost, ::1, [::1], and all port-suffixed variants via ipaddress.ip_address().is_loopback.
• _get_server_host(scope) — reads the actual bound address from the ASGI server tuple (set by uvicorn, not attacker-controlled).

In _is_request_origin_allowed(), when the server is on loopback and no explicit allow-list is configured, the function now additionally requires that the Origin header also resolves to a loopback host — blocking the DNS-rebinding attack regardless of what the Host header says.

Legitimate same-origin requests (browser at http://localhost:8000 → server at 127.0.0.1:8000) continue to work. Explicit --allow-origins configuration overrides the guard as before.

Tests

21 new unit tests in tests/unittests/cli/test_dns_rebinding_protection.py covering:

• _is_loopback_address for all host formats (IPv4, IPv6, bracketed, with/without port, hostnames)
• DNS-rebinding attack blocked for IPv4 loopback, named localhost, and IPv6 ::1
• Legitimate same-origin requests remain allowed
• Explicit --allow-origins allowlist still overrides the guard
• Non-loopback servers (e.g. 0.0.0.0) are unaffected

Impact

Without this fix, any web page a developer visits while running adk web can:

• Invoke the agent with arbitrary prompts via POST /run
• Read all agent session history and memory
• Call any state-changing API endpoint on the local ADK server

Severity: Medium (requires the victim to visit a malicious page while the dev server is running; limited to the local machine).