Add new self-service auth method for iOS/iPadOS

[cdcme]

Implements #36542. Adds URL/UDID-based authentication for the My Device page on iOS/iPadOS.

Summary

This implements URL-based authentication as a simpler, temporary alternative to certificate-based authentication (#35009).

The device's UUID is embedded in the WebClip URL using $FLEET_VAR_HOST_UUID. When the cert serial header isn't present, but the device UUID is, Fleet validates that it belongs to an iOS/iPadOS device. Sensitive host data is automatically scrubbed from responses.

Details

• Adds AuthenticateDeviceByURL() to validate UUID and enforce iOS/iPadOS platform restriction
• Extends device endpoint middleware with checkURLAuthQueryParam to detect ?udid=true
• Adds AuthnDeviceURL authentication method to authz package
• Scrubs sensitive data (serial, UUID, MAC, team, profiles, labels, license details) from responses when using URL auth
• Maintains backward compatibility with token-based and certificate-based auth

Security considerations

URL-based auth is inherently less secure than certificate auth since anyone with the correct URL can access the device page.

Mitigations:

• Platform restriction ensures only iOS/iPadOS devices can use this method
• Sensitive data is scrubbed from responses (serial numbers, UUIDs, MACs, team info, profiles, labels)
• License information is redacted
• Feature is implemented specifically with fast-follow deprecation in mind

Testing

• Unit tests for AuthenticateDeviceByURL() covering success, not found, and wrong platform
  cases
• Endpoint tests for URL auth middleware behavior
• Integration tests verifying authorization across all device endpoints
• Manual testing of self-service software installation flow
• Verified backward compatibility with existing token auth

[codecov]

Codecov Report

❌ Patch coverage is 89.87342% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 65.94%. Comparing base (b9b4ba1) to head (0f1bd65).
⚠️ Report is 90 commits behind head on main.

Files with missing lines	Patch %	Lines
server/service/devices.go	82.35%	5 Missing and 1 partial ⚠️
server/service/hosts.go	89.47%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #36659   +/-   ##
=======================================
  Coverage   65.94%   65.94%           
=======================================
  Files        2248     2248           
  Lines      183797   183874   +77     
  Branches     7676     7676           
=======================================
+ Hits       121198   121249   +51     
- Misses      51524    51547   +23     
- Partials    11075    11078    +3     

Flag	Coverage Δ
backend	67.70% <89.87%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[iansltx]

Thanks for the quick turn on the initial work and the feedback. This looks good, given intended functionality.