ADO code-search endpoint override is workspace-scoped while authenticated requests use it

- Copilot Chat Extension Version: `0.59.0`
- VS Code Version: latest `main`, commit `dd862885ff5fbd279747c793e18105e6b7ddc805`
- OS Version: Windows 11 `10.0.26200` build `26200`
- Feature: Copilot semantic/code search for Azure DevOps repositories
- Selected model: No live model is required for the deterministic test
- Logs: Local loopback proof only; no Azure DevOps or other production service was contacted

## Summary

`github.copilot.chat.workspace.prototypeAdoCodeSearchEndpointOverride` is registered without an application-only scope or a restricted-setting marker. It is consequently accepted as a workspace-effective value.

`AdoCodeSearchService.searchRepo` uses the configured value as its request endpoint while attaching the ADO Basic authorization credential. This couples a workspace-selected network destination with a credential-bearing request.

## Steps to Reproduce

1. Check out commit `dd862885ff5fbd279747c793e18105e6b7ddc805`.
2. Register the real Copilot `advanced` configuration contribution with VS Code's configuration registry.
3. Parse a workspace configuration containing `github.copilot.chat.workspace.prototypeAdoCodeSearchEndpointOverride` set to a loopback HTTP listener.
4. Supply `AdoCodeSearchService` with a dummy ADO session credential.
5. Invoke `searchRepo` through the production service and networking request path.
6. Inspect the loopback request.

Observed on latest `main`:

```text
setting_registered=true
setting_scope_window=true
setting_restricted=false
workspace_setting_survived_restricted_parse=true
real_ado_service_invoked=true
basic_authorization_received=true
dummy_token_received=true
no_production_service_contacted=true
```

## Expected Behavior

A workspace should not be able to choose the origin that receives an authentication credential. The override should be application-scoped/restricted, or the final credential-bearing endpoint should be constrained to expected Azure DevOps origins.

## Actual Behavior

The workspace-effective override becomes the complete request endpoint, and the ADO authorization header is attached to the resulting request.

## Relevant Source

- `extensions/copilot/package.json:4625-4633` registers the endpoint override with only `advanced` and `experimental` tags.
- `src/vs/platform/configuration/common/configurationRegistry.ts:726-754` supplies the default configuration scope when none is declared.
- `extensions/copilot/src/platform/remoteCodeSearch/common/adoCodeSearchService.ts:257-279` obtains the credential, selects the override endpoint, and performs the authenticated request.
- `extensions/copilot/src/platform/authentication/vscode-node/authenticationService.ts:71-73` constructs the Basic credential from the ADO session access token.

## Impact and Scope

After the outer Copilot/workspace-trust gate has been satisfied, repository configuration can determine the destination of a credential-bearing ADO code-search request.

The bundled Copilot extension is not enabled in Restricted Mode by default, so the proof does not establish credential release before Workspace Trust. This is therefore presented as a low-severity product-hardening issue rather than a Workspace Trust bypass.

## Suggested Fix

- Register the override as application-scoped and restricted.
- Validate the final endpoint origin before attaching the authorization header.
- Consider keeping endpoint selection and credential attachment in separate APIs so an arbitrary configured URL cannot inherit authentication.
- Add a regression test proving workspace configuration cannot redirect an authenticated request.

## Existing-Issue Review

I searched issues and pull requests in `microsoft/vscode` and `microsoft/vscode-copilot-release` for the exact setting, `AdoCodeSearchService`, endpoint overrides, workspace-controlled ADO destinations, and credential/authorization terminology.

Issues `#309682` and `#320570` concern ADO semantic-search retry and refresh behavior. They do not concern endpoint selection, configuration scope, or credentials being sent to a workspace-selected origin.