fix: anchor Klaviyo proxy endpoint allowlist to the full path shape [] - #11294

…w messages

The window message listener that completes the OAuth flow accepted
any message posted to the window, regardless of where it came from
or which window sent it.

Reject messages that don't come from the app's own origin, or that
don't come from the popup window this instance actually opened.

The proxy's endpoint allowlist only checked the segment before the
first slash, so a value like "template-universal-content/../lists"
passed the check while the traversal segment let the request reach a
Klaviyo endpoint that was never allowlisted.

Replace the prefix check with a pattern anchored to the exact shape
the app actually sends (an allowed endpoint, optionally followed by a
single id segment), rejecting anything else outright.

Covers exact allowlist matches, an allowlisted endpoint plus a single
id segment, and traversal attempts that previously bypassed the
prefix-only check (verified these fail against the pre-fix code and
pass against the anchored-pattern fix).

Widen the vitest include glob to pick up functions/ tests — the
functions/ directory previously had no test coverage at all.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

The allowlist check moved to ALLOWED_ENDPOINT_PATTERN; ALLOWED_ENDPOINTS
only survived as an internal building block for that regex. Inline it
directly into the pattern literal instead of keeping a separate binding
nothing else reads.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>