restrict msgraph pagination nextLink to the configured host

[Samin061]

paginated_run follows the @odata.nextLink from each Microsoft Graph response and refetches it with the connection's bearer token attached, while Kiota's allowed_hosts defaults to empty (any host) when no authority is set, so a tampered response can send the token to an arbitrary host. Pin follow-up pagination requests to the configured endpoint's host and refuse a nextLink that points elsewhere.

[dabla]

I don't think allowed_netloc should be initialized here. The variable itself makes sense, but it should be computed inside the async run() method where it's actually used. Initializing it here unnecessarily couples this code to the connection lookup and may perform work earlier than needed.

[Samin061]

Good point, moved it inside run() so the lookup only happens when pagination actually runs.

[potiuk]

@Samin061 — Some review feedback from @dabla is waiting on you: 1 unresolved review thread(s). Could you either push a fix or reply in each thread explaining why the feedback doesn't apply? When you believe the feedback is addressed, please mark the threads as resolved and ping the reviewer (@dabla) for a final look. Thanks!

---

Note: This comment was drafted by an AI-assisted triage tool and may contain mistakes. Once you have addressed the points above, an Apache Airflow maintainer — a real person — will take the next look at your PR. We use this two-stage triage process so that our maintainers' limited time is spent where it matters most: the conversation with you.