SPARK-833337: Remediate five medium security findings

[mkesavan13]

COMPLETES #https://jira-eng-gpk2.cisco.com/jira/browse/SPARK-833337

This pull request addresses

SPARK-833337 reports six medium security findings in Contact Center widgets. This PR addresses five findings: WF-05, WF-06, WF-07, WF-08, and WF-10.

CG-01 / AC-1 is intentionally deferred because it requires changing .github/workflows/update-dependencies.yml, and the Jira-to-PR automation token does not have the workflow permission required to push GitHub Actions workflow changes. The deferment is also recorded in the PR conversation.

by making the following changes

• Adds OAuth state validation to mitigate CSRF in the React sample application (WF-05).
• Removes localStorage persistence for integrationEnv and uses build-time configuration (WF-06).
• Replaces the ambiguous DN prefix character class with explicit alternation and adds regression coverage (WF-07).
• Adds a synchronous useRef in-flight guard to prevent duplicate digital-channel initialization and adds regression coverage (WF-08).
• Restricts window.store exposure to non-production builds in the React and web-component samples (WF-10).
• Updates the affected cc-components and cc-digital-channels specifications.

Change Type

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Tooling change
• Internal code refactor

The following scenarios were tested

• The testing is done with the amplify link

Automated verification performed:

• Spec-currency gate passed.
• Compile gate passed.
• Unit-test gate passed.
• cc-components: 819 passed, 4 skipped.
• cc-digital-channels: 26 passed.
• Repository commit hooks completed with zero test failures and zero lint errors.

The GAI Coding Policy And Copyright Annotation Best Practices

• GAI was not used (or, no additional notation is required)
• Code was generated entirely by GAI
• GAI was used to create a draft that was subsequently customized or modified
• Coder created a draft manually that was non-substantively modified by GAI (e.g., refactoring was performed by GAI on manually written code)
• Tool used for AI assistance (GitHub Copilot / Other - specify)
  • Github Copilot
  • Other - Claude Code through Jira-to-PR automation
• This PR is related to
  • Feature
  • Defect fix
  • Tech Debt
  • Automation

Checklist before merging

• I have not skipped any automated checks
• All existing and new tests passed
• I have updated the testing document
• I have tested the functionality with amplify link

---

Make sure to have followed the contributing guidelines before submitting.

[mkesavan13]

Scope note for SPARK-833337:

The original remediation also changed .github/workflows/update-dependencies.yml for CG-01 / AC-1. GitHub rejected that branch push because the Jira-to-PR automation token does not have the workflow permission required to modify GitHub Actions workflow files.

For this PR, that workflow-file change was intentionally restored to origin/next, allowing the remaining five fixes (WF-05, WF-06, WF-07, WF-08, and WF-10) to be pushed and reviewed. CG-01 / AC-1 is not fixed by this PR and requires a follow-up change pushed by a credential with workflow-write permission or by an authorized human.