@spec check_token_passthrough(String.t(), [{String.t(), String.t()}], map()) ::
  {:ok, [{String.t(), String.t()}]}

Checks for and prevents token passthrough to external resources.

It classifies the URL, and if it's external, it strips sensitive headers. This is a key part of preventing confused deputy attacks.

@spec classify_url(String.t(), [String.t()]) :: :internal | :external

Classifies a URL as :internal or :external based on trusted origins.

Trusted origins are hosts that are considered part of the same security domain. Wildcard matching (*.example.com) is supported for subdomains.

@spec extract_origin(String.t()) :: {:ok, String.t()} | {:error, :invalid_uri}

Extracts the origin (scheme://host:port) from a URL string.

@spec strip_sensitive_headers([{String.t(), String.t()}], :internal | :external) :: [
  {String.t(), String.t()}
]

Strips sensitive headers if the resource classification is :external.