chore: backport mcp server editor configuration disclosure

[azmkercso]

Backport MCP server editor configuration disclosure from upstream Code-OSS (commit be09b4c7).

Changes

• Add patches/common/fix-mcp-server-editor-disclosure.diff — shows environment variables, env file, and headers in the MCP server editor deeplink install UI
• Update patches/backported-patches.json with all findings from the May 18 security scan
• Add @backported and @finding-id metadata to backported patch headers

Testing

• prepare-src.sh applies all patches cleanly for all 4 targets
• No lockfile changes needed (source-only patch)

[azmkercso]

Issue

V2213552988

Description of Changes

Backport MCP server editor configuration disclosure from upstream Code-OSS (commit be09b4c7). Adds environment variables, env file, and headers display to the MCP server editor deeplink install UI. Also registers non-applicable advisories in backported-patches.json with note field and adds @backported/@finding-id metadata to patch headers.

Testing

• prepare-src.sh applies all patches cleanly for all 4 targets (sagemaker, web-server, web-embedded, web-embedded-with-terminal)
• Source-only patch — no lockfile changes needed

Screenshots/Videos

N/A

Additional Notes

Sibling PRs: #224 (main), #223 (1.0)

Backporting

Already applied to main (PR #224) and 1.0 (PR #223 — metadata only, vulnerable code path does not exist in Code-OSS 1.101.2).

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.