fix(teams): authenticate Bot Connector attachments

[Proxicon]

Summary

• The Teams downloader requests the existing Bot Framework app token only for Bot Connector attachment hosts.
• It requests https://api.botframework.com/.default and adds a Bearer header to the attachment GET.
• It keeps the existing teams-attachments client. HTTPS-only, redirect block, byte limit, staging, and scan controls stay active.
• SharePoint, OneDrive, and other trusted signed URLs receive no Bot Framework token.
• The change adds no Graph permission, credential configuration, actor contract, or persistence field.

Tests

• Bot Connector authorization header and app scope.
• Token exclusion from logs, actor input, metadata, and URLs.
• Unsigned and signed non-Connector URL behavior.
• Connector 200 byte limit, 401 stable rejection, token failure, raw URL boundary, and redirect block.

Validation

• dotnet restore Netclaw.slnx
• dotnet build Netclaw.slnx --no-restore -m:1 /nodeReuse:false
• dotnet test Netclaw.slnx --no-build --no-restore -m:1 /nodeReuse:false
• Focused Teams suite: 242 passed.
• Focused downloader suite: 20 passed.
• dotnet slopwatch analyze
• pwsh ./scripts/Add-FileHeaders.ps1 -Verify

The full build reports one existing Aspire CLI bundle warning.

Scope check

git diff --name-only dev...HEAD contains only the Teams daemon downloader, Teams tests, and Teams documentation.