[feature] SC-166737/improve app proxy security by restricting where token replacements can go

[HappyPaul55]

This pull request updates the proxy configuration in manifest.json to support dynamic injection of authentication settings for Atlassian API requests. The main change is the addition of the settingsInjection field, which allows sensitive credentials and tokens to be injected into request headers or bodies as needed for different endpoints.

Proxy configuration enhancements:

• Added settingsInjection for the https://auth.atlassian.com/.* endpoint, enabling injection of client_id and client_secret into the request body, and api_token into the header.
• Updated the https://(.*).atlassian.net/.* and https://api.atlassian.com/.* endpoints to support injection of api_key and username into request headers via the new settingsInjection field.

[Copilot]

Pull Request Overview

This PR enhances the proxy configuration security by introducing the settingsInjection field to restrict where sensitive authentication settings can be injected. The changes limit token and credential replacements to specific headers or body fields for each Atlassian API endpoint, reducing potential security vulnerabilities.

Key changes:

• Added settingsInjection configuration for three Atlassian endpoints to control where credentials can be injected
• Reordered proxy whitelist entries (moved auth.atlassian.com to the top)
• Restricted credential injection to specific locations (headers or body) per endpoint

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Build for commit 40a09b7 deployed to: https://jira-pr-97.ci.next.deskprodemo.com

URLs:
https://jira-pr-97.ci.next.deskprodemo.com/horizon-ui/app