Add outbound blocking

[bitterpanda63]

Summary by Aikido

Security Issues: 0	🔍 Quality Issues: 2	Resolved Issues: 0

🚀 New Features

• Implemented outbound domain blocking and integrated it across collectors.

⚡ Enhancements

• Added thread-local PendingHostnamesStore bridge between URL and DNS collectors.

🔧 Refactors

• Reworked context and URL handling to remove Hostnames and simplify logic.

^{More info}

[aikido-pr-checks]

DNSRecordCollector.report now performs enforcement (may throw BlockedOutboundException) in addition to reporting. Rename or document the method to reflect enforcement, or move blocking logic to a separate method.

Details

✨ AI Reasoning
​The DNSRecordCollector.report method was changed to both report DNS records and enforce blocking by throwing BlockedOutboundException when a hostname is blocked. The method name 'report' no longer fully conveys that it can perform enforcement side-effects. Mixing collection/reporting with blocking logic makes the purpose less self-evident and can surprise callers expecting a pure reporter method. This harms readability and makes error handling assumptions unclear to callers.

🔧 How do I fix it?
Use descriptive verb-noun function names, add docstrings explaining the function's purpose, or provide meaningful return type hints.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}

[codecov]

Codecov Report

❌ Patch coverage is 39.39394% with 20 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...erabilities/outbound_blocking/OutboundDomains.java	0.00%	14 Missing ⚠️
...v/aikido/agent_api/storage/ServiceConfigStore.java	0.00%	3 Missing ⚠️
...aikido/agent_api/storage/ServiceConfiguration.java	0.00%	3 Missing ⚠️

📢 Thoughts on this report? Let us know!

[aikido-pr-checks]

report() now calls PendingHostnamesStore.clear(), introducing an unexpected side-effect and mixing responsibilities. Move this clearing to a clearly named method or document/rename report() to reflect the additional behavior.

Details

✨ AI Reasoning
​The WebRequestCollector.report method previously handled initial request context setup and basic blocking checks. The change adds a call to clear a global/thread-local PendingHostnamesStore, which introduces a side-effect unrelated to the method's documented purpose. This mixes responsibilities and makes the function's purpose less self-evident: a caller expecting only context/reporting behavior may be surprised that pending hostnames are flushed here. The doc comment for report was not updated to reflect this new behavior, so the purpose is now unclear without reading implementation.

🔧 How do I fix it?
Use descriptive verb-noun function names, add docstrings explaining the function's purpose, or provide meaningful return type hints.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}