#8366 fix(search): validate a new provider server before the approval transaction

Summary

• Approving a search provider took the connected-accounts advisory lock inside its transaction and then ran the provider server's DNS/SSRF validation while still holding it. A slow resolver held the lock and a pooled connection for the full lookup
• prepareSearchMcpProvider now runs before the transaction. It skips DNS when the organization already has the server (same as before) and validates the URL up front for a new one. createManagedMcpConnector accepts the pre-validated input, so nothing resolves under the lock
• If the server is removed between preparation and the transaction, the approval returns a conflict ("try again") instead of creating it unvalidated
• Error mapping is unchanged (toSetupError dedupes it). The organization-accounts and workspace callers still validate inside their own flow
• Responds to a review thread on #8356

Type of Change

• Bug fix

Testing

• New integration test: a separate connection can take the accounts lock during the DNS lookup, so the lookup runs outside the lock. The test fails on the pre-fix code
• An existing provider still approves with DNS unavailable
• Type-check and the credential-group unit suites pass

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)