[SDL Assessment task] Secure webview settings, Fixes AB#3288572

[somalaya]

SDL assessment task : https://securityassurance.visualstudio.com/Threat%20Modeling/_workitems/edit/80425

As per above SDL assessment task, we have secure some input settings in webview

WebSettings settings = webView.getSettings();
settings.setAllowFileAccess(false);
settings.setAllowContentAccess(false);
settings.setAllowFileAccessFromFileURLs(false); // Requires API 16+
settings.setAllowUniversalAccessFromFileURLs(false); // Requires API 16+

Keeping the changes behind a flight which will be true only in brokered flow for now https://github.com/AzureAD/ad-accounts-for-android/pull/3168

Fixes AB#3288572

[github-actions]

❌ Work item link check failed. Description does not contain AB#{ID}.

Click here to Learn more.

[Copilot]

Pull Request Overview

This PR implements security hardening for WebView settings in the OAuth2 authorization flow as part of an SDL (Security Development Lifecycle) assessment task. The changes disable various file access permissions to prevent potential security vulnerabilities.

Key changes:

• Refactored WebSettings variable naming for consistency and reuse
• Added security settings behind a feature flag to disable file access capabilities
• Applied defensive security measures to prevent unauthorized file system access from WebView

[github-actions]

✅ Work item link check complete. Description contains link AB#3288572 to an Azure Boards work item.