PR #8362 - simstudioai/sim

Summary

Every Databricks tool built its request URL from the user-supplied workspace host without checking it was a Databricks workspace, so the workspace token went to whatever host was entered. The executor's DNS and pinned-IP guard already blocks private targets; this closes the rest
All 26 Databricks tools (12 original, 14 Genie) now build their URL through databricksUrl, which runs the same validateDatabricksWorkspaceHost allowlist the Databricks KB connector uses and builds from the sanitized https origin. Request paths, methods, headers, and bodies are unchanged
The allowlist gains .cloud.databricks.mil (AWS GovCloud DoD workspaces) and .databricks.com (Databricks custom workspace URLs), so no workspace host that worked before is refused. http:// hosts keep being upgraded to https
validateVendorHostedUrl strips a single trailing FQDN dot before the suffix check and builds the URL from the dotless host. A trailing-dot host now connects: Bun's TLS check rejects the dotted name. This applies to Databricks, ServiceNow, and Workday; hosts without a trailing dot are unchanged
Responds to a review thread on #8356

tools/databricks/databricks.test.ts: foreign and lookalike hosts are refused by all 26 tools before any request. The accepted host forms (bare, https, http, trailing slash, whitespace, AWS, GovCloud, DoD, GCP, Azure, Azure Gov, Azure China, a custom URL) build the same URLs the old tools built, and trailing-dot hosts build a dotless URL. The refusal, .mil, custom-URL, and trailing-dot cases fail on staging
Databricks, ServiceNow, and Workday tool and connector suites, plus input-validation suites (263 tests), type-check, lint, and check:audits pass

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)